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(54) Note-paper sheet issuance device 
(57) tn a small-sized electronic appar> 
atus having at least a time counting 
circuit IB) and a printing section (8), 
when a note-paper sheet issuance key 
(6a) Is operated a note-paper sheet, on 
which the present time data is printed 
and also which has a blank space for 
receiving messages, '*" BU ! d .'J h * k 
apparatus is particularly suited for tak- 
ing memoranda of telephone calls. 
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SPECIFICATION 
Note-paper sheet issuance device 



« in our daily IK*, there often occurs an occasion when 
* one responds to a telephone cell address* to n 
absent person and writes a message of the calhng 

na message as such is sometimes reduced in 

a meSeoe or the like therein, in response to the 
Ste data and a printing section connected to the 

oravide a note-paper sheet with the present t.nw 
d^rpHntedthe'reonbyone-touch kj^nj^on. 
Thus when the invention is applied to a table 
telephone set with printer, in case of taking memo of 

meSb^ 

keying operation, and this Is veryconvenien J. In 
instant of reception of the message can be savea, 

60 W ^ ;i S ablockdiagramshowinga P rintin 9 

^SSSS is a flow chart illustrating the operation of 
a note-paper sheet issuing apparatus; and 
fSLXJ 3 and 4 show examples of the format of 
65 note-paper sheet. 



Now, an embodiment of the invention will be 
described with reference to Figures 1 through ,4. 
Flourel outlines the construction of a printing 

cl^inr, in which various microcommands are 
Zl n ^ubtractingoperations-ltasolncudes 
various registers such as A and B registers for 
75 temporarily memorizing data at the time of display 
SK. transfer and arithmetic processing of data. 
An inpS control section 2, a display control section 
3 a Sng control section 4 and a time counting 

trnl section 2 is providing a timing signal KP to an 
louSon t and when keying operation is done 
85 SSu^ectlon 6 the timing signal , to selectively 
SdaVakeyedinpLitsignaltotheinputbuffer 
memory IB of the input control section 2 according 
Crated key. The input section 6 is provided 

90 "9" andfunchonkeysforcouplingan hme^^ 
structions as well as a note-paper issuing key 6a 
Sch is operated wh*n issuing a note-paper sheet. 

buffer HB P and segment signal SG .c^njd... 

data oi the like are digitally displayed according to 

lu0 th Th^ 

buffer PB for detecting the coincidence of printing 

110 Pr T n he d time counting circuit 5 includes a data i infor- 

lis mation of the present time, namely hour and minute 
1 ? B ?X«of. Thedata memorized in the memory 
Son M, and M 2 are automatically renewed in 

formd within the time counting circuit 5. 
120 Designated at 10 is a stamping section In this ^ 

section, impressions "From — - - 

and "Content of message" are f^J*™{ 
stamp drive command is given from the CPU 1 

ns'TCSonofthetabietelephonesetwith 
Printer of the above construction for issuing a 

to an Sent person is received and it b rW to 
write a message of the calling person on a note 
130 paper sheet, the note-paper sheet issuance key 6a is 
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(low clBit of F'aure « » *° nt year, month 

Sine interval, tn this step, the present da e 
Jhownin Figure 2. In the following step S„ the 

SSpSwentlime information, for instance 
« "it?!" is printed. In thefollowlng step S 5 ,a bar 

2p S* a stamp drive command is produce^ f rom 

*amping~ 

of CPU 1. In the following step Sa the »»r«>dB 
written in the Aregister is transferred to the panting 
3r PS and bar codesf or one lire are printed in 

45 not orintino of bar codes for 6 lines has been 
ASS? ctaetad. If the ^eckyie.ds"yes' , the 
operation of producing a note-paper sheet is ended 

sheet issuance key 6a once, a note-paper sheet on 
which the present data and time data are printed as 

ScanLtesurnamesofthe calling and called 
55 persons in the predetermined spaces. 

Ftgure4shows a difference example of the format 
of the note-paper sheet which is issued when the 
note paper sheet issuance key 6a is operated in th» 

60 sheet isfed to a predetermined ex tent and then the 
data and time data are printed after the blank space 

of the note-paper sheet. For example, instead of the 
65 format shol in Figure 3, a blank space may be 



provided byfeeding the sheet by a predetermined 
interval after the printing of the data and time data, 
in Figure 4. the aforementioned stamped .mpress- 
70 ions of the characters and bar codes may be given. 
Furthithecontentofthestamped impressions* 

various stamped impression may be prov.ded de- 
pending upon use. 



CLAIMS 

1 . An apparatus for issuing note-paper sheets 
comprising: 

80 a keying section having a note-paper sheet 

'TSaTSocessing unit connected* said keying 

6B a£e counting circuit connected to «Me«MI 
85 Processingunitforautomatical^rene^ngthepre- 
senttimedaw such as present hourand minute 

paper sheet issuance key is operated. 
95 2 AnapparatusaccordingtoClaiml.wherein: 
95 saidttme^urrfngcircuitau^ 

nresent date and time data consisting of present 
datedataand presenttime and minute » d 
said printing section prints said present date and 

sheet forprovidingablankspace before thestartOT 
or after the end of the printing operation at the time 

105 AnapparatusaccordingtoClaiml.wherein 
pricing section prints said present time data at 
Z tfm = when said note-paper sheet issuance key Is 

^determined interval before the start of or after the 
110 end ofthe printing operation. 

4 An apparatus according to Claim 1, whicr. 
furthercomprisesa stamping section connected to 
HwSSal processing unit for providing stamped 
impressions on the recording; sheet emerging from 

115 said printing section. . „u„ oin . 

5 An apparatus according to Clatrn l, wherein^ 

said keying section hasten ^^So^ 
for supplying arithmetic commands** addition, 
subtraction, multiplication and dwision: 
120 saE n t;aiprocessingunitexecutescalcu.at,ng 

0P sXint1ng section prints numerai data and data 

125 tia«v at hXbefore described with reference* the 
accompanying dr awings. 

ce by Croydon Printing Company 

Buitdrofl*. London, WCiA 1 AY 
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System for printing encrypted messages with barcode representation. 
@) A system for the metering of encrypted postage and simi- 
lar Indicia incl udes e device (32i for printing such Indicia and a 
device (34) for reading such indicia. The printing is accomp- 
lished with a bar-code printer driven by signals obtained from 
a keyboard (48) and from an encryption circuit. The reading is 
accomplished with a bar-code reader to relreiva the charac- 
ters, and permit the comparison of the separated coded data 
with a reference code to determine the accuracy of the printed 
materia!. Both the data and the code area Imprinted by a 
bar-code indicia, a portion of the code being set aside for the 
data and a portion of the barcode being set aside for encryp- 
tion purposes. Thereby, the two portions can readily be sepa- 
rated to allowf or a utometic readingof the bar code for extrac- 
tion of the message, while also allowing for automatic verifi- 
cation |54| by use of the encrypted materiel. 
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SYSTEM FOR PRINTING ENCRYPTED MEBfiflfiBfi 
WITH BAR-CODE RSPPJSSESTATTOH 



This invention relates to devices for the 
metering of postage and similar indicia and/ ^ par _ 
ticularly, to a metering device including electronic 
circuitry for the encryption of the indicia to be 



printed. 



Reference is hereby made to copending related 
patent applications assigned to the seme assignee as 
this application, application of John Clart entitled 
"System Having A Character Generator For Printing 
Encrypted Messages", s «ial Ho . 5,5 on, fii Bd on 
*U 19, ,m, application of John clar* and Daniel 

-titled "system Por Printing Sncrypted Usages 
«tt A Character Generator And Bar-code Representation", 
«rial No. 5,5 07 2 , filed on July „ f 1983; ana appu _ 
«tion of j ohn clar*, Alton Eclcert and David Warren 
entitled "System For Printing Anfl Rfiadlng Qf ^ 
Messages", seria! No. 5,5 760, filed on July 21 , , 983 
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Pctag* meters find extens . ve ^ ^ 

the United States and abroad, for w^,- 

' for imprinting postage on 

Ml -» ti c Wng . label „ hich iB lmprlnted ■ . ^ pr . nt 

" adh8rln9 e ° nta " - «" Pa~ el or other ob - 

J-* to b e Mllea . «tern ativ e ly , the pMtage ^ ^ 
Printed direct ly on the oaler wapping ^ 

1,611,9 ■ naiIed - ** i. aisc c apabl e 

of printin, . short Mssage addiUon tQ 

°r the pos ta g e so that, i£ teirea , ^ ^ _ ^ 

— for the lnprintln? of 6ultable indicia d esi , natlng 
instruction, „ d/or routing fQr trans , ort ^ ^ 

carrier a* „ ell as by the ^ rurthermorei „ 
■^red, the meter may be „ tuued fQr ^ 

•—in, that ^ernaentai approval for suoh t ^ ^ 
is obtained. 

A serious proMen, which „ as been encountered 
*» th. use of printed posteoe i 5 the traudulent ^ 
t.ration o f such post ag e iaheis Bhereby , in ^ ^ 
Person aduiteratin, the Post a g e ls 5teaUn9 r 
fraudulent liW may e „ able so „ eo „ e ^ ^ ^ 
or in the ca5e of . ^ ^ ^ ^ ^ ^ ^. 
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. Thereby, the message imprinted on the 
•elated to the encryption markings. In the 
t the message is altered, either the 

markings cannot be decoded or, if decoded, 
ing legend does not agree with the legend 
an the label. 
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In Figure l, a system 20 incorporates the 
invention for the transmission of a mailpiece or pack- 
age 22 from a sending station 24 via a delivery system 
26 to a receiving station 28. The term "package" is 
used only by way of example to illustrate the variety 
of objects which are sent from one location to another, 
both by use of the mail and by private carrier. Thus, 
the tern -package- includes mailpieces such as letters, 
flat., envelopes, parcels and other objects which are 
sent via the mail, and have a surface for receipt of 
imprintings of postage and/or other indicia including 
messages. The tern, "package" also includes labels in 
those situations wherein the indicia or message is im- 
printed on a label which i, then affixed tQ a 
mailpiece, in the case of postage, or to some other 
object .such as bottle wherein the label is a tax stamp. 
The delivery system 26 may be any one of a number of 
systems such as, for example, a parcel delivery service 
or the postal service. The portrayal of the system 20 
in Figure 2 is stylized to facilitate explanation of 
the invention, with portions of the stations 24 and 28 
being cut away to show components thereof utilized in 
the imprinting and reading of data on the outer cover. 
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such as an envelope, of the mailpiece 22. 

In accordance with the invention,, the data is 
encrypted to ensure the validity of the data. The data 
includes, typically, the fee or postage, the date, a 
serial number of the sending station 24, and, if 
desired, a zip code or other form of routing code for 
automated sorting of the mailpieces 22. ' The encryption 
is accomplished by coding circuitry, to be described 
hereinafter, which utilizes a seed word in developing 
the code. The seed word is obtained frcn'a base seed ' 
word 30 placed in both the sending station 24 and the 
receiving station 28, the base seed word 30 being al- 
tered in a manner to be described, 'in' accordance with 
the date, the fee, and the serial number of the sending 
station 24 to provide the seed word utilized by the 
coding circuitry. The sending station 24 includes a 
print system 32 for imprinting the data on' the 
mailpiece 22, while the receiving station 2B incorpo- 
rates a corresponding read system 34 for reading" the 
data imprinting on the mailpiece 22 . ' 

The print system 32 comprises a matrix print- 
er 36 which includes a well known set of electronically 
actuated dot printing points in a printing head which, 
in accordance with electrical signals applied to re- 
spective ones of the points, imprints a row of "dots 
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which represent a portion of a letter, numeral, or oth- 
er character. For example, such a printing head may 
incorporate ink jets or f alternatively, may employ heat 
or light in the case wherein heat-sensitive labels or 
light-sensitive labels are utilized. The mailpiece 22 
is moved along a platform 38 of the sending station 24 
by a roller 40 , the roller 40 advancing the mailpiece 
22 beneath the matrix printer 36 as the printer 36 im- 
prints a succession of dots on the cover of the 
mailpiece 22. A sensor 42 detects the presence of the 
package 22 for activating the roller 40. The sensor 4 2 
nay have the form of any of a number of well known 
package sensors, to incorporate, for example, an elec- 
tric eye or a roller which makes electrical contact 
with the roller 40. Thereby, a breaking of the light 
beam, or a breaking of the electric current signals the 
presence of the package 22 for activation of the roller 
40 to advance the package 22. The roller 40 and the 
matrix printer 36 are positioned by means of a frame 44 
within the sending station 24. 

The receiving station 28 also incorporates a 
roller 40 and a sensor 42 for advancing a package along 
a platform 38. A connector 43, shown in phantom inside 
the sending station 24, is coupled to the sensor 42 for 
counting output signals of the sensor 42 to provide a 
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count of the respective packages 22 sensed by the sen- 
sor 42. The read system 34 includes a matrix sensor 
46, the sensor 45 comprising a set of well known pho- 
to-electric sensors which are arranged along a row and 

5 positioned by a frame 44 as described previously for 
the sending station 24. The positions of the photo- 
electric sensors of the matrix sensor 46 corresponds to 
the positions of the print points of the matrix' printer 
36 so that the presence and absence of markings of "the 

20 printer 36 can be sensed by the matrix sensor 46, 

The sending station' 24 further comprises a 
keyboard 48 and an alphanumeric display 50. The key- 
board 4 8 includes function keys which' identify the na- 
ture of the data which is being entered by data e'ntry 

15 keys of the keyboard 48.' Thus, for example, individual 
ones of the function keys are employed to identify the 
date, the amount of the fee, and routing data. The 
data to be entered appears in the .display 50 after 
which it is entered into the electronic circuitry of 

20 the sending station 24 by pushing an enter key of the 
keyboard 48. The receiving station 28 also incorpo- 
rates displays, there being a data display 52 as well 
as a verification display 54 which indicates that the 
message imprinted on the package 22 has been verified 

25 or that it has been obliterated so as to prevent veri- 
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fication. 

With reference also to Figure 2, there is 
shown a mode of encripting alphanumeric characters of 
the message imprinted on the mailpiece 22. This mode 
of encryption, which may be referred to as variable 
void coding is accomplished by offsetting the dots im- 
printed by respective printing points of the printer 36 
so as to create voids at locations which would normal- 
ly, in the absence of encryption, have imprinted dot. 
The field of dots in Figure 2 is defined by a matrix of 
seven rows by five columns. Such a matrix is a stan- 
dard matrix in the printing industry and, accordingly, 
is most readily employed in a postage meter or similar 
device for the imprinting of postage and transportation 
data on a mailpiece. While the invention is useful for 
fields of both larger and smaller arrays of dots than 
that disclosed in Figure 2, in order to facilitate ex- 
planation of the invention, it is to be assumed in the 
ensuing description that the 7 x 5 matrix is to be em- 
ployed. Individual ones of the dots in Figure 2 are 
identified by the legends 56 while two exemplary dis- 
placed dots 56A and 56B are disclosed in phantom. The 
phantom view indicates the postions which a dot 56 
would occupy in the presence of encryption, the normal 
position, indicated by solid lines, being present in 
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the absence of encryption. In particular, it is noted 
that the displacement associated with the encryption 
provides a void equal to one-half the width of the dot 
56. Thus, as may be seen in the cross-bar of the let- 
5 ter "A" depicted in Figure 2, the offsetting of the dot 
56B enlarges the space between neighboring dots, to the 
left of the dot 56B, while decreasing the space, be- 
tween neighboring dots, to the right of the dot S6B. 
Accordingly, the void or space between one pair of 

10 neighboring dots is increased while the void or space 
between another set of neighboring dots is decreased. 
In the encryption process, only a relatively few of the 
dots of an alphanumeric character are so displaced, the 
remaining dots maintaining their regular positions to 

15 permit identification of the character imprinted on the 
mailpiece 22. 

In accordance with a feature of the in- 
vention, a reference character without the displaced 
dots of the encryption process is compared to a re- 

20 ceived character having the displaced dots associated 
with the encryption process. The differences between 
the characters is thus a statement of the code. 

Figure 2 also shows a grid 58 superposed on 
the character "A* to explain the operation of the ma- 

25 trix sensor 46. The spacing between photoelectric ele- 
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ments of the matrix sensor 4 6 corresponds to the spac- 
ing between the rows of the grid 58, the horizontal 
lines being parallel to the arrow 60 which designates 
the direction of movement of the mailpiece 22. The 
spacing between the rows of the grid 58 is smaller than 
the spacing between centers of the elements of the ma- 
trix sensor 46 so as to permit the reading of the dots 
or other shaped markings of the character imprinted by 
the printer 36. Similarly, the rate of reading by the 
matrix sensor 46 is increased to provide a spacing be- 
tween columns of the grid 5B which is smaller than the 
spacing between the dots of the printed character so 
that the matrix sensor 46 is able to' respond to the 
variations in spacing between the dots resulting from 
the displacement associated with the encryption. By 
way of example, the spacings depicted between centers 
of the dots of the character in Figure 2 are four times 
the spacing of the cells of the grid 5B. Correspond- 
ingly, the grid 58 provides the read system 34 with a 
resolution four times that of the print system 32, and 
thereby enables the read system 34 to function even 
with characters that may have become partially oblit- 
erated, as well as in the situation wherein the align- 
ment of the package 22 on the platform 38 in the re- 
ceiving station 28 does not correspond precisely to the 
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corresponding alignment in the sending station 24. " 

With reference now to Figure 3A, there ' is 
provided a more detailed description of the components 
of the print system 32 of Figure 1. The drum 40 is 
mechanically coupled via a line 62 to drive unit 64 
which rotates the drum 40 for advancement of the 
mailpiece 22. The same form of drive unit 64 is also 
provided in the read system 34 of Figure 4A, as will be 
described subsequently, for rotation of the drum 40 
therein. The drive unit 64 comprises the mailpiece 
sensor 42, a motor drive circuit 66, a stepping motor 
68, a gear train 70 mechanically coupled via a dashed 
line 72 to the motor 68, a shaft-angle pulser 74 also 
■mechanically coupled via the line 72 to the motor 68, 
and an address counter 76. ' 

In operation, the motor 68 is energized by 
the drive circuit 66 for rotation of the drum 40 via 
the gear train 70. The drive circuit 66 is triggered 
into operation by the sensor 42, and continues to oper- 
ate the motor 68 until the sensor 42 ceases to sense 
the presence of the mailpiece 22. Thereby, the druin 40 
is made to rotate a sufficient amount to move the 
mailpiece 22 past the drum 40. The momentum of the 
mailpiece 22 then carries it through the sending sta- 
tion 24, as well as through the receiving station 28 as 
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will be described substantively with respect to Figure 
4A. The gear train 70 reduces the rate of rotation of 
the drum 40 to a much slower value than the rate of 
rotation of the output shaft of the motor 68 on line 
72. The shaft-angle pulser 74 comprises well known 
circuitry such as that of a tachometer or encoder for 
providing an output electrical pulse to the counter 76 
for each increment in rotation of the output shaft of 
the motor 68. Since the pulser 74 is mechanically 
locked to the arum 40 by the gear train 70, a counting 
by the address counter 76 provides a count which corre- 
sponds precisely to the position of the mailpiece 22 on 
the platform 38 of the sending station '24. The leading 
edge of the electric output signals of the sensor 42 on 
line 78 resets the counter 76 back to zero upon the 
arrival of the next mailpiece 22 at the sensor 42. The 
output count of the counter 76 will be utilized, as 
described hereinafter, for addressing components of the 
print system 32 for operation of the matrix printer 36. 

The print system 32 further comprises an ad- 
dress generator 80, a timing unit 82 an address genera- 
tor 84, a RAM 86 (random access memory) for the storage 
of data entered from other components including the 
keyboard 48 and the counter 43, a coder 88 for provid- 
ing the encripting code as will be more fully described 
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in Figure 5, a memory 90, a memory 92, and a set of 
void units 94 for driving respective ones of a set of 
print points 96 of the matrix printer 36. Each void 
unit 94 is utilized for incorporating digits of the 

5 encryption code which are stored in the memory 92 into 
the printing process for displacing dots of the charac- 
ter matrix in accordance with the variable-void feature 
of the invention. Each void unit 94 comprises a shift 
register 98, two AND gates 101-102 , and an OR gate 103. 

10 in the AND gate 102, of the input terminals t thereof is 
complimented, this terminal being coupled along with a 
corresponding terminal (not complimented) of the gate 
101 to the code memory 92. 

In operation, a person utilizing the sending 

15 station 24 enters data into the RAM 86 by use of the 
keys of the keyboard 48. As has been noted herein- 
above, the keyboard 48 is also coupled to the display 
50 for displaying the data which is. to be entered into 
the RAM 86, During entry of the data, the signals of 

20 the keys of the keyboard 48 are also applied to the 
address generator 80 to activate the generator 80 to 
address the RAM 86. to designate the locations wherein 
the data of the keyboard 48 is to be stored within the 
RAM 86. The generator 80 is also utilized for address- 

25 ing the RAM 86 during the outputting of data from the 
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RAM 86 to the coder 88 and to the memory . 90, the action 
of the generator 80 initiated by signals of the timing 
unit 82 during the outputting of the storage data. The 
timing unit 82 also initiates activity of the address 
generator 84 to designate locations within the memory 
90 for receiving data from the RAM 86. The coder 83 
utilizes the data of the ram B6 in providing the digits 
which are stored in the code memory 92, and the memory 
90 is utilized for applying the data of the RAM 86 via 
the void units 94 to the print points 96 of the matrix 
printer 3 6. 

During the first stage of the operation of 
the sending station 24, the data such as the amount of 
postage, the routing as via zip code, the date and the 
package count of the counter 43 are entered into the 
RAM 86 for the subsequent imprinting of a message on 
the package 22. The message includes the date, the 
package count, the serial number of the sending station 
24, the delivery fee or postage, and optionally zip 
code and/or city, state of the origination. In accor- 
dance with the invention, the message also includes, in 
encrypted form, a verification of the message showing 
that the message was indeed printed by the sending sta- 
tion 24, and not by an impostor. 

Accordingly, the second stage in the opera- 
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tion is the transfer of data from the RAM 8$ to the 
coder 88 for the generation of the encrypted 
verification, and to the memory 90 for operation of the 
matrix printer 36. The first two stages are initiated 
sequentially in response to the aforementioned signals 
of the timing unit 82 to the generators 80 and 84. 
During the second stage of the operation, the coder 88 
generates the requisite code and applies the digits for 
control of the encryption process to the code memory 92 
in a manner to be described subsequently with reference 
to Figure 5. 

The third stage of the operation begins when 
the package sensor 42 has detected the presence of a 
mailpiece 22 or other object such as a letter which is 
to be mailed. As has been noted above, the sensor 4 2 
resets the counter 76 and initiates operation of the 
motor drive circuit 66 with the resultant counting of 
the counter 76. The counter 76 counts out successive 
addresses of both the print memory 90 and the code mem- 
ory 92 for transferring the data contained therein to 
the matrix printer 36. During the transfer of data 
from the RAM 86 to the memory 90, the data is arranged 
in accordance with the rows of dots of the matrix of 
each character which is to be imprinted on the 
mailpiece 22. Thus, in response to each designation of 
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character by the keyboard 4B, the RAM 86 makes avail- 
able to the memory 90 the succession of dots for each 
row of the characters matrix as has been explained with 
reference to Figure 2. Accordingly, upon transfer of 
the data from the RAM 86 to individual sections of the 
print memory 90, respective sections of the memory 90 
store the requisite sequence of dots which are to be 
applied by the corresponding print points 96 to the 
mailpiece 22 during the printing operation. 

In response to the addressing by the counter 
76, the data is read out of the respective section of 
the memory 90 and of the respective sections of the 
memory 92 into the corresponding void .units 94 for ap- 
plication to the. corresponding printheads 96. With 
respect to the operation of the void units 94 , each 
void unit 94 operates in the same manner. In each void 
unit 94, data from the memory 90 is applied to an input 
terminal of the shift register 98 through which it is 
clocked at a higher rate than the entry of data from 
the memory 90 into the register 98. For example, the 
rate of clocking in the register 98 may be at a rate 
four times greater than the rate of entry of the data 
from the memory 90 into the register 98. The clocking 
is accomplished in response to clock pulses applied at 
terminal C from a clock (not shown) within the timing 
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unit 82. 

The foregoing factor of four in the clock 
rate corresponds to the factor of four (described • in 
Figure 2) between a dot of the printed character and a 

5 cell of the grid 58. Thus, as a digital signal enters 
the shift register 98 from the memory 90 , the digital 
signal then propagates rapidly through the shift regis- 
ter 98 through successive cells thereof. As these dig- 
ital signals propagate through the shift register 98, 

10 the mailpiece 22 is advanced by rotation of the drum 1 
40. Each increment in time associated with the propa- 
gation from cell to cell of the shift register 98 cor- 
responds to an increment in postion of ' the package 22. 
Each cell of the register 98 is provided with an output 

15 tap or terminal whereby a signal can be extracted after 
a predetermined amount of delay from the time of trans- 
fer of the signal from the memory 90 "to the shift reg- 
ister 98. 

Each row of the code memory 92 is coupled to 
20 a corresponding one of the void units 94. More specif- 
ically , as has been described above, in each void unit 
94, an output line of the code memory 92 is applied to 
an input terminal of each of the gates 101-102. In 
response to the outputting of a logic 0 signal from the 
25 code memory 92, the AND gate 102 is activated due to 
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the complementing of its input terminal coupled to the 
memory 92. With the activating of the AND gate 102, 
the digital signals of the shift register 98 are cou- 
pled via the AND gate 102 and the OR gate 103 to the 
print point 96. In response to the outputting of a 
logic 1 signal from the code memory 92, the AND gate 
102 is deactivated and the AND gate 101 is activated to 
pass a digital signal from the shift register 98 via 
the OR gate 103 to the printhead 96. Since the AND 
gate 101 is coupled to a cell of the register 96 down- 
stream from the connection of the AND gate 102 to a 
cell of the register 9B f the activation of the gate 101 
results in a delay of the operation of the print point 
96. In view of the continuous motion of the package 92 
by the rotation of the drum 40, the delay introduced by 
the gate 101 results in a displacement of the position 
of the dots, such as the previously described displace- 
ment of the dots 56A-B of Figure 2. In view of the 
ratio of four cells of the grid 58 corresponding to the 
spacing between centers of the dots 56 of Figure 2, the 
delay of one of the registers 98 (as depicted by the 
connections of the gates 101 and 102 to the register 
9B> provides for a displacement equal to one-half the 
width of a dot 56 as depicted in Figure 2. According- 
ly, for each occurrence of a logic 1 from the code mem- 
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ory 92, there is presented a corresponding displacement 
in the position of a dot of the character in Figure 2. 
For ease of portraying such displacements, only two 
such displacements are shown in the Figure, this being 
the displacement of the dots 56A-B. With the displace- 
ment, there is created a void at the site where the dot 
56 would have been located in the absence of the 
encripting command from the signals of the code" memory 
92. Thus, a void unit 94 has introduced a void into 
the printed character so as to encrypt the character 
with a code that is to be utilized for verifying the 
printed message. 

With reference to Figure 4A r , the read system 
34 operates in a manner complementary to that of the 
print system 32 of Figure 3A. As has been noted 
hereinabove, the receiving station 28 includes a drum 
drive unit 64 for rotating a drum 40 to advance the 
package 22 beneath the matrix sensor 46. The reset 
line 78 of the drive unit 64 is also utilised to reset 
a timing unit 106 which provides timing signals at ter- 
minals Tl and T2 for operating components of the system 
34 as will now be described. 

The read system 34 comprises a RAM 108, a 
correlator 110, an address generator 112, a memory 114, 
buffer storage unit 117-118, a RAM 120, an address gen- 
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erator 122, a subtracter 124, a memory 126 and a 
correlator 128. Also included in the system 34 are 
the data display 52 and the verification display 54 , 
previously described with reference to Figure 1, as 
well as an optional display 52A. In addition, the sys- 
tem 34 includes a coder 88 and a code memory 92 which 
have been described with reference to Figure 3A. 

In operation, upon the sensing of a mailpiece 
22 at the receiving station 28 {Figure 1), the address 
counter 76 of the drive unit 64 addresses the RAM 108 
to enter data from the matrix sensor 4 6 as the mail- 
piece 22 moves along the platform 38. The counting of 
the counter 76 is synchronized with the movement of the 
package 2 2 by the shaft-angle pulser 74. The counter 
7S includes an additional terminal designated as termi- 
nal A in Figures 3 and 4, for providing a high speed 
counting at a rate four times that -of the addressing 
rate utilized in the print system 32 of Figure 3A- 
This is readily accomplished by deleting the 
least-significant bits from the lower rate counting 
output terminal of the counter 76. The counting rate 
at the terminal A of the counter 76 is utilized in Fig- 
ure 4A to address the RAM 108 at the rate corresponding 
to the density of the cells of the grid SB in Figure 2. 
Thus, as the package 22 advances past the matrix sensor 
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46, the signals of the photo-electric elements of. the 
matrix sensor 46 are sampled and are entered into the 
RAM 108 at the rate four columns of the grid 58 for 
each column of dots 56 of the character in Figure 2. 
In addition, the close spacing of the photo-electric 
elements of the matrix sensor 46 provide for four rows 
of samples, in the grid 58 for each row of dots 56 of 
the character in Figure 2. The matrix sensor 46 ex- 
tends well beyond the top and bottom of the text print- 
ed on the bottom of the mailpiece 22 to be able to 
receive the printed message even if the imprint on the 
mailpiece 22 is slightly offset from the position of 
the matrix sensor 46. 

The operation continues with the correlator 
110, the address generator 112, the memory 114 and the 
buffer storage units 117 and 11B. The operation of the 
correlator 110 is initiated by a signal of the timing 
unit 106 subsequent to the storing of the data in the 
RAM 108. The timing signal is obtained with the aid of 
the package sensor 42 which changes the state of the 
signal on line 78 from a logic 1 to a logic 0 when the 
mailpiece 22 has completely passed by the sensor 42. 
Thereby, the timing unit 106 is signalled by the sensor 
42 that the reading of data by the matrix sensor 46 has 
been completed and that accordingly, the stored data 
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can be outputted from the RAM 108. 

The correlator 110 and the address generator 
112 react with the RAM 103 in a well known fashion for 
transferring the message from the RAH 108 to the stor- 
age unit 217. Automated readers of printed matter are 
commercially available, and are equipped with circuitry 
for extraction of the message even if the object being 
read is slightly offset from the orientation of the 
reading head. Such an adjustment offsetting is readily 
accomplished by correlating received symbols with sym- 
bols stored in a reference memory, this being the memo- 
ry 114. By cycling through the various storage cells 
of the RAM 108, the correlator 110 correlates the indi- 
vidual characters stored in the RAM 10S with the refer- 
ence characters of the memory 114 so as to determine 
which characters, or symbols have actually been sensed 
by the matrix sensor .4 6. When a correlation is ob- 
tained between the received symbol and the reference 
symbol, the correlator 110 triggers the generator 112 
to address a location in the storage unit 117 for en- 
tering the received symbol. Simultaneously, with the 
using of the storage unit 117, the generator 112 also 
addresses the storage unit 118 for entering the refer- 
ence symbol from the memory 114. The character, or 
symbol, stored in the storage unit 117 differs from 
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that stored in the storage unit' 118 in that the re- 
ceived character of the storage unit 117 includes the 
variable voids of the encryption process while the 
characters stored in the storage unit 118 is free of 
the voids of the encryption process. The succession of 
reference characters entered into the storage unit 116 
are also applied via the memory 114 and the address 
generator 112 to the HAM 120 so as to store the data of 
the complete message in the RAM 120. 

The final step in the operation of the read 
system 34 can now be accomplished by utilizing the data 
stored in the storage units 117-118 and in the RAM 120. 
First t it is noted that the reference symbols are 
provided by the memory 114 to the correlator 110 and to 
the storage unit 118 in the form of the dot matrix pre- 
sented in Figure 2 so that a comparison can be made 
between the dot-matrix representation of the character 
in the storage unit 117. With respect to the RAM 120, 
the memory 114 provides only a digital word identifying 
each of the characters. Since the storage unit 118 
contains the complete dot-matrix representation of each 
symbol, the symbols are readily outputted from the 
storage unit 118 directly to the data display 52. 
Thereby, as the characters are successively outputted 
from the storage units 118 to the display 52, the en- 



-27- 



0132782 



tire message builds up within the display 52 for pre- 
sentation to a person utilizing the receiving . station 
28 of Figure 1. 

In accordance with a feature of the In- 
vention, the verification of the received message is 
obtained by comparing the received characters of the 
storage unit 117 .with the corresponding reference char- 
acters of the storage units- 118. This is accomplished 
by subtracting, cell by cell in accordance with the 
grid 58, the data stored in the storage unit 118 from 
the data stored in the storage unit 117. The cell- 
by-cell process is implemented by sequentially address- 
ing the respective storage locations ' by the address 
generator 122. The address generator 122 is operated 
in response to a timing signal from the timing unit 106 
so as to implement the foregoing addressing after the 
correlator 110 has directed the entry of the characters 
into the storage units 117-118. The subtraction is 
accomplished by the subtractor 124, and the results of 
the subtraction are entered into the memory 126 in re- 
sponse to an addressing thereof by the generator 122. 
It is readily appreciated that, with reference to a 
comparison of the characters stored in the two storage 
units 117-118, that in the event that corresponding 
cells of the grid 58 have equal value of logic signals, 
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the logic 0 or a logic 1, then the output of the sub- 
tractor 124 is zero. On the other hand, if a void is 
present due to the encryption process, then the logic 
value stored at the corresponding grid cells will dif« 

5 fer and, accordingly , the subtracter 124 will output a 
logic 1 to the memory 126. Thereby, the memory 126 
stores, a representation of the encryption code as re- 
ceived by the receiving station 28. Assuming that 
there has been no obliteration of the printed message, 

10 and that the printed message is a valid message as dis- 
tinguished from a message printed by an impostor, then 
the array of data stored in the code memory 126 will be 
identical to the array of data stored in the code memo- 
ry 92 of Figure 3A. 

15 The data stored in the code memory 126 is to 

be compared with the data of the code memory 92 to de- 
termine that a valid message has been transmitted. 
Accordingly, . the coder 88 of Figure 4A is activated 
with the received data in the RAM 12D in the same man- 

20 ner as was described previously for the activation of 
the coder BB with the data of the RAM 86 in Figure 3a. 
The coder 88 (Figure 4A) then generates the reference 
code for storage in the memory 92. The codes of the 
memories 126 and 92 are then, correlated by the cor- 

25 relator 128 which signals the display 54 to indicate a 
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verification upon the obtaining of a good correlation, 
or to show obliteration, in the event that an 
inadequate correlation is obtained. It . is to be under- 
stood that an inadequate correlation can be due to 
either obliteration or the act of an impostor, in ei- 
ther case, the user of the receiving station 28 has 
been alerted to the fact that the message imprinted on 
the . mailpiece 22 cannot be verified. Both the cor- 
relators 128 and 110 are understood to include an ad- 
justable reference level against which the correlation 
is performed since, in practice, it must be assumed 
that various markings such as dirt and scratches will 
appear on the package 22 which will pr6vide a less than 
perfect correlation even with a valid message. 

If desired, the display 52A may be used to 
present the alphanumeric indicia with the variable void 
coding. For this purpose,, the output signals of the 
storage unit 117, in addition to being coupled to the 
subtracter 124, are also coupled to the display 52A. 
In addition, the foregoing output signals. of the sub- 
tractor 124 are also coupled to the display 52A, these 
signals being synchronized with corresponding ones of 
the storage unit 117 and indicating the presence of a 
displaced pixel. In response to the subtractor 
signals, the display 52A provides for a blinking or 
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coloring of the displaced pixels so that personnel 
utilizing the read system 34 can readily observe the 
coding of the indicia. 

With reference to Figure 5, there is shown a 
simplified representation of a codex 88. Coding de- 
vices are readily available commercially and by way of 
example, a maximal- length shift-register code generator 
is described in Figure 5. The coder 88 comprises a 
shift register 130, which stores a seed word, and is 
driven by a clock 132, A set of modulo-2 adders 134 
sum the contents of successive ones of the cells of the 
shift register, with the resultant sum being inputted 
to the first cell of the register 130. ' The contents of 
the right-hand cell of the shift register 130' is des^ 
ignated as the output terminal of the coder 88. 

In accordance with a feature of the in- 
vention, the seed word is generated by use of input 
data relating to one or more parameters such as the 
date, the fee, the serial number of the sending station 
24, and the count of mailpieces and other packages 
provided by the counter 43. Accordingly, the coder 88 
further comprises a register 136 for receipt of the 
input data, a ROM (read only memory) 138 and three add- 
ers 141-143. The ROM 138 stores a set of seed words 
which are addressed in accordance with the three least 
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significant bits of the data, there being accordingly 
eight base seed words stored in the ROM 138. The 
selected base seed word is then added modulo- 2 with the 
fee at the adder 141 and again added modulo-2 with the 

5 serial number of the sending station 24 at the adder 
142, and again added modulo- 2 with the piece count of 
the counter 43. The serial number is being permanently 
stored in the register 136. The output digital word of 
the adder 143 is then loaded into the shift register 

10 130 to serve as the seed word from which the code is 
generated by the coder 38. 

It is to be understood that the foregoing 
contributions to the seed word are presented by way of 
exanple. Thus, if desired, the contribution ' of the 

15 serial number and/or the fee may be deleted. The use 
of the date and the piece count in the composition of 
the seed word is advantageous in providing a seed word 
which varies from mailpiece to mailpiece and from day 
to day, a clear benefit for improved security. In the 

20 event that a microprocessor (not shown) be incorporated 
in the sending station 24 and the receiving station 28, 
other forms of codes can be generated such as those of 
the National Bureau of Standards based on the multipli- 
cation of pairs of large numbers. 

25 Tne foregoing print system and read system 
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has provided an effective way of introducing an 
encrypted code into a printed message which can readily 
verify the validity of the message. The use of the 
variable voids permits the message to be read either 
5 manually or by machine, while obtaining the encrypted 
identification. It is also noted that the foregoing 
systems also are applicable for any form of printed 
symbol, whether readable manually or only by machine. 
Thereby, if desired, the imprintings on the mailpiece 
10 22 can be accomplished with a set of nonsense symbols 
which are recognizable only by use of the stored refer- 
ence symbols in the read system. Thereby, a system for 
assuring payment of the fee imprinted for postage, tax- 
es and other purposes has been disclosed. 

15 It is furthermore noted that the message need 

not be imprinted only on a flat type of package but 
that, if desired, the message may be imprinted on a 
label or stamp which can later be affixed by labeling 
equipment to a. container such as a bottle. Thereby, 

20 the system of the invention can also be utilized for 
the affixation of tax stamps to liquor bottles as well 
as to other objects requiring a tax. The reading pro- 
cess can then be accomplished automatically, and has 
been described hereinabove, by use of a conveyor (not 

25 shown) to move the bottle or other objects past the 
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matrix sensor for reading the legend imprinted on the 
tax stamp or other label. Thereby, fraudulent stamps 
or labels can be detected. 

COMBINATION OF CODED SYMBOLS WITH DATA SYMBOLS 

By way of alternative embodiments, it is not- 
ed that the security can be obtained by having a set of 
characters which designate the date, the fee, the piece 
count and the serial number of sending, the station, 
with additional characters being supplied as a code. 
The characters of the code are based on the values the 
date, the fee and the serial nuraber as has been dis- 
closed in the previous embodiment. The code characters 
may be applied after piece count, or interleaved there- 
with. In. either event, a predetermined timing arrange- 
ment is utilized as to determine which of the charac- 
ters represent the data, and which of the characters 
represent the code. 

Figure 3B shows a print system 200 which is 
an alternative embodiment of the print system 32 of 
Figure 3A. The system 200 provides for the printing of 
data characters plus code characters, and includes many 
of the components of the system 32. The system 200 
comprises a ROM {read-only memory) 201, a print memory 
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202, an address generator 204, an OR circuit 206 , and a 
timing unit 208 which provides for the arrangement of 
the characters as is portrayed in the graph 210. Also 
included in the system 200 are components which have 
been previously described, namely, the display 50, the 
keyboard 48 , the address generator 80, the timing unit 
82, the address generator 84, the BAM 86, the coder 88, 
the print memory 90, the drive unit €4, the code memory 
92, the matrix printer 36, and the drum 40. Since the 
print system 200 provides both the data and the coding 
by means of alphanumeric*, the matrix printer 36 may be 
replaced by some other form (not shown) of alphanumeric 
printer if desired. 

The operation of the system 200 follows that 
of the system 32. Thus, the coder 88 provides a code 
vord based on the date, the fee, the serial numberV and 
the piece count which then produces the code- in the 
memory 92. The output terminals of the memory 92 pro- 
vide an address for selecting a code symbol or code 
character from the BOM 201. The print memory 90, under 
instruction from the address generator 84, stores the 
data which is to be printed on the tailpiece 22. Simi- 
larly, the print memory 202, under instruction from the 
address generator 204 stores the code characters which 
are to be imprinted on the mailpiece 22. The operation 
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of the generators 84 and 204 is controlled by timing 
signals from the timing unit 82. The arrangement of 
the contents of the memory 202 follows that of the 
memory 90 so that the contents of the memory 202 can be 

5 applied directly to the matrix printer 36. The data of 
the memory 90 and the code of the memory 202 are cou- 
pled alternately via the OR circuit 206 to the matrix 
printer 36. Timing signals for operation of the read 
out of the contents of the memories 90 and 202 is ac- 

10 compiished by signals of the timing unit 208, the tim- 
ing unit 208 being driven by an output signal of the 
address counter 76 of the drive unit 64. Thereby, as 
the drum 40 advances the package 22 before the printer 
36, the printer 36 imprints the package with both the 

15 data characters and the code characters as is portrayed 
in the graph 210. 

One relatively simple . form of code which may 
be imprinted on a mailpiece or other form of package 22 
consists of a four-digit number representing the piece 

20 count of the counter 43 followed by a one digit code 
number. The coding operation (Figure 5) involves the 
modification of a base seed word by key board-entered 
data, such as the fee and the date. . Other data such as 
the serial number and the piece count are entered auto- 

25 matically into the RAM 86 for use by the coder 88 . 
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As an example of still further data Which may 
be utilized by the coder 88 , in lieu of the foregoing 
or in addition thereto, are the total amount of prepaid 
postage stored in a system of registers 212 and the 
weight of a mailpiece or package' 22 as provided by a 
scale 214. The register system 212 and the scale 214 
are connected to the RAM 86, as shown in phantom in 
Figure 3B, and also appear in Figure 1. With 'reference 
to Figure 5, the register 136 of the coder 88 would be 
enlarged to include the weight and total prepaid post- 
age, and additional adders (not shown) such as the add- 
er 141 would be employed to combine the weight and 
postage with the base seed word. 

Figure 4B presents the companion read system 
220 for the print system 200. The system 220 is" sub- 
stantially less complex than the read systen 34, the 
reduced complexity being obtained by a manual entry of 
the printed data on the mailpiece 22 into the system 
220. Upon entry of the printed data into the system 
220, the date, the fee, the piece count and the serial 
number are utilized, as previously described with ref- 
erence .to the read system 34, to produce the corre- 
sponding code. If the piece weight is utilized, the 
package is weighted and the weight is entered at the 
keyboard. If the prepaid postage is utilized for 
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assumed transmission by the postal service, such value 
is known at the post office (herein the receiving sta- 
tion 28) so as to be enterable by the keyboard. In the 
read system 220, the regenerated reference code appears 

5 on a display for visual comparison by an operator of 
the system. f 

The system 220 comprises the keyboard 48, the 
display 50, the RAM 86, the coder 88 and the code memo- 
ry 92 which have been previously described with refer- 

10 ence to Figures 3A and 3B. In addition, the system 220 
includes the ROM 201, previously described in Figure 3B 
and a display 222. In operation, the person using the 
system 220 reads the message printed on the mailpiece 
22, and enters the characters via the keyboard 48. The 

15 keyboard 48 activates the display 50 to show the char- 
acters entered,, thus, providing the message comprising 
the date, the fee, piece count and the serial number of 
sending station. The keyboard 48 also activates the 
RAM 86 to provide the date, the fee the piece count and 

20 the serial number (and the weight and prepaid postage 
if this date is utilized) to the coder 88 which uti- 
lizes this data to produce the code in the memory 92. 
The code words in the memory 92 then address a ROM 201 
to produce the code characters on the display 222. In 

25 the event that the data has been improperly entered 
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into the keyboard 48, a bogus address may be applied by 
the code memory 92 to the ROM 201 in which case a fault 
indicator will be illuminated on the display 222 - to 
alert the operator of the system* Alternatively , if 

S there has been a tampering with the message imprinted 
on the package, the display 222 may show a set of code 
characters, however, the set shown on the display 222 
will differ from that actually imprinted on the package 
22. Thereby, the operator of the system 220 has been 

10 alerted to a tampering of the printed message. 

With respect to the read system 220, it is 
noted that should it be desirable to have automatic 
reading instead of the manual inputting, the read sys- 
tem 34 of Figure 4A is readily modified to provide 'the 

15 function of the system 220 of Figure 4B. • Such modi- 
fication is attained by replacing the correlator 110 
(Figure 4A) with a timing unit, corresponding to the 
timing unit 206 of Figure 3B, for alternately switching 
the data and the code characters received from the 

20 photosensor 46 into the buffer storage units 118 and 
117. The ROM 201 would be connected between code memo- 
ry 92 and correlator 128, and the buffer storage unit 
117 would be coupled directly to the correlator 12 8. 
Thus, the correlator 128 would directly correlate the 

25 set of code characters which was read from the package ' 
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22 with the set of code characters of the reference. 
Upon obtaining a proper correlation , the display 54 
would indicate verification of the printed message. 

BAR-CODE EMBODIMENT 
The message printed on the mailpiece 22 by 
the succession of characters, as disclosed in Figure 
3B, may alternatively be printed by means of a bar code 
as is now disclosed in the print system 400 of Figure 
3C. The print system 400 has components previously de- 
scribed with reference to the print system 200 of Fig- 
ure 3B, these components being the keyboard 48, the RAM 
86, the coder 88, the code memory 92 and the ROM 201. 
The operation of the system 400 follows that of the 
system 200 and, accordingly, the characters commanded 
by the keyboard 4B are applied by the RAM 86 to the 
coder 86, and also to a buffer storage unit 402. The 
coder 88 utilizes the information of the date, the fee, 
and the serial number of the sending station to gener- 
ate the coded words which are stored in the memory 92. 
If desired, the piece count may also be utilized. The 
output lines of the memory 92 address the ROM 201 to 
select suitable alphanumeric characters which can be 
printed by a bar code printer. The system 400 further 
comprises an OR circuit 404 and a bar code printer 406, 
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with the OR circuit 404 being connected to output ter- 
minals of both the ROM 201 and the storage unit 402 for 
alternately coupling the output signals to the printer 
406. The alternate coupling is accomplished by timing 

5 signals provided by a timing unit such as the timing 
unit 208 which was utilized in the system 200 of Figure 
3B, The printer 406 is understood to include the gen- 
erator and other circuitry commonly found in bar code 
printers for converting the character command signal to 

10 a succession of lines of the bar code (not shown) . The 
printer 406 then imprints the bar code on the mailpiece 
22. The presentation of the printed message on the 
mailpiece 22 follows that disclosed in the graph 210 of 
Figure 3B. 

15 The companion read system 420 for the print 

system 400 is disclosed in Figure 4C. The system 420 
functions in a manner analagous to that of the read 
system 34 of Figure 4A, and contains some of the compo- 
nents of the system 34 as well as components of the 

20 print system 400 of Figure 3C. The system 420 com- 
prises the drum 40, the drive unit 64, the timing unit 
106, the coder 88, the code memory 92, the ROM 201 and 
the verification display 54 previously disclosed in 
Figures 4A and 3C. In addition, the system 4 20 com- 

2S prises a bar code reader 422 of well-known configura- 
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tion, a ROM 424 for converting output digital signals 
of the reader 422 to the actual symbol represented by 
the reader 422, a ROM 426 for converting the output 
digital signal of the reader 422 to the input digital 
5 format utilized by the coder 88, and a correlator 428. 
Both the bar code printer. 4.0-6 of Figure 3.C and the 
reader 422 as v/ell as the actual .code are well known 
and are in common use. A portion of a bar code is por- 
trayed, by way of example, on the mailpiece 22. 
10 In operation,, the drum 40 advances the 

mailpiece before the reader =422, enabling the reader 
4 22 to read the code and apply the resultant characters 
of the reading to the ROMs 424 and 426: The drum 40 is 
driven by the drive unit 64 which, as has been dis- 
„ 15 closed previously, with respect to Figure 4A, activates 
the timing unit 106 to .provide- timing signals syn- 
chronized to the movement of the d-rum 40 and the pack- 
age 22. The output data pf the ROM -426, comprising the 
date, the- fee, and the serial number, of the sending 
20 station, and/or other data is loaded into the. coder 88. 
The coder 88 utilizes the foregoing data to provide 
code words which are stored in the memory 92 and are 
applied as addresses to the ROM 201 for providing al- 
phanumeric symbols corresponding to the code words. 
25 The generation of the alphanumeric symbols by the ROM 
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201 in Figure 4C is the same as the symbols generated 
by the ROM 201 of the print system 4 00 in Figures 3C, 
assuming that the bar code was validly imprinted on the 
mailpiece 22. The contents of the ROM 424 and 201 may 
5 comprise the actual form of the respective symbols or, 
alternatively, may comprise a digital word identifying 
the alphanumeric symbol. In either case, the contents 
of the ROM 424 and the ROM 201 are clocked out by 
signals of the timing unit 106 into the correlator 428. 
10 The correlator 428 correlates the symbols of the re- 
spective ROMs 424 and 201 to determine that the code 
characters actually read by the reader 422 agree with 
those predicted by the operation of the coder 88 based 
on the date, the fee, and the serial number of the 
15 sending station. Upon obtaining a satisfactory corre- 
lation, the correlator 428 activates the display 54 to 
show verification of the printed message. 

It is further noted that a mailpiece sorting 
system (not shown) may be coupled to the bar-code read- 
20 er 4 22 for use in those situations wherein a zip code 
or other routing code has been imprinted on the pack- 
age. Upon recognition of the routing code, the sorter 
then dispenses various packages in a series of such 
packages into various bins for automatic sorting of 
25 mail and similar packages. The output signal of the 



correlator 42S may be utilized to activate the sorter 
so that no sorting takes place unless the message im- 
printed by the bar code on the package 22 has been 
declared valid. Thereby, an automatic sorting system 
can be used with a secure routing indicia imprinted on 
the packages. 

COMBINATION OF ALPHANUMERIC AND BAR CODES INDICIA 

The alphanumeric print system 200 of Figure 
3B and the bar-code print system 400 of Figure 3C may 
be combined to form the print system 6 00 of Figure 3D. 
In comparing Figures 3C and 30 with 3D, it may be seen 
that each of these systems employ the keyboard 48, the 
RAM 86 the coder 88, the code memory 92 ana the drum 
40. Accordingly, the combined system 600 uses the 
foregoing components to activate both the matrix print- 
er 36 and the bar-code printer 406. In the physical 
construction of the system 600, the two printers 36 and 
406 may be positioned side-by-side so as to provide, 
simultaneously, both the alphanumeric and the bar-code 
indicia. 

If desired, the bar-code printer 406 could 
employ the apparatus of the matrix print head of the 
printer .36, in which case each bar of the code would be 
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printed as an array of closely 'spaced dots. Further- 
more, if the alphanumerj.es and the bar code are to be 
printed sequentially, rather than side-by-side, then a 
single print head could be used for both imprintings 

5 with the control circuitry being alternately switched 
from the alphanumerics to the bar code. This system is 
advantageous in that it permits the automatic sorting 
of mail, the automatic verification of the indicia, as 
well as the manual reading of the indicia so that per- 

10 sonnel handling packages and mail can visually identify 
the imprinted legends if they so desire. 

The companion read system 620 is shown in 
Figure 4D. The system 620 incorporates components of 
the system 34 of Figure 4A for reading printed alpha- 

15 numeric characters and other symbols. Also included 
are both the bar-code reader 4 22 and the matrix sensor 
46 for reading respectively the bar code and the alpha- 
numeric characters. Also included are the drum 40, the 
drive unit 64 and the timing units 106 of both Figures 

20 4A and 4C. Interpretation of the bar code is accom- 
plished with the aid of the ROMs 424 and 426, the coder 
88, the code memory 92 and the ROM 201 of Figure 4C. 
The character processing is implemented by use of the 
RAH 108, the correlator 110, the address generator 112, 

25 the symbol memory 114, the buffer storage 118 and the 
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RAM 120 of Figure 4A. Also included, by way of a sec- 
ond channel in the signal processing of the system 620 
are the coder 88, the code memory 92, the symbol ROM 
201 and the correlator 128. The RAM 120, the coder 88 

5 and the memory 92 function as was disclosed with refer- 
ence to Figure 4A. By use of the ROM 201, addressed by 
the memory 92, the character predicted by the coding 
operation is attained in a manner corresponding to that 
disclosed in Figure 4C. The predicted character from 

10 the ROM 201 and the actually received character from 
the buffer storage units 118 are correlated by the 
correlator 128. The output of the correlation is ap- 
plied to the verification display 54' along with the 
output of the correlator 4 28. Thereby, correlation and 

15 verification can be obtained from the examination of 
the bar code or from examination of the alphanumeric 
code characters. The display 54 will respond to a pos- 
itive correlation from either of the correlators 428 
and 128. The display 52 displays the characters which 

20 have been received, this includes both the data charac- 
ters and the characters of the code. In the system 
620, while the complete array of characters is dis- 
played for an operator of the system, the correlation 
is accomplished automatically without aid of the opera - 

25 tor, as- distinguished from the manually-aided read- 
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system 220 of Figure 4B.. ■'< 

INTERLEAVING OF CODE WITH INDICIA 

5 With reference now to Figures 3E, 4E and 6, 

there is described an alternative form of the print and 
read systems utilizing an interleaving of the. code with 
the indicia by speckling the indicia with portions of a. 
code disposed as I's and 0*s across the field of the 

10 indicia. Such speckling- is shown in Figure 6, while 
the corresponding print system .800 and the read system 
650 are shown, respectively , in Figures 3E and 4E. 

' The print system 800 is a modification of the 
system 32 of Figure 3A and incorporates the keyboard 

15 48, the address generator 8Q r the piece counter 43, the 
coder 88, the drive unit 64, and the drum 40 shown pre- 
viously in Figure 4A. Instead of the 7 by 5 matrix 
format previously described,- a larger field is employed 
to more easily implement the speckling procedure. For 

20 example, a 9 by 9 or larger matrix may be employed. 
Accordingly, the matrix printer of Figure 3A has been 
replaced by a larger-; format printer 36A in Figure 3E. 
The system 800 further comprises RAM's 802 and 804, 
ROM's 806 and 808, and a set of switches 810 of which 

25 there is one switch for each row of the indicia matrix. 
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Each switch 810 comprises two AND gates 811 - B12, and 
an OR gate 813. 

The speckling procedure, as demonstrated in 
Figure 6, interjects light areas into the dark 

5 coloration of the indicia, such as the exemplary nu- 
merals 2 and 3 of Figure 6, and interjects dark areas 
into the relatively light coloration of the background. 
The logic l's represent points of impact of the print 
head while the logic O's represent areas where no mark- 

10 ings have been applied by the print head. In each sym- 
bol field, regions have been set aside for the 
speckling , the speckling in each of the regions being 
done on a random or pseudorandom basis.' 

In operation, the keyboard 48 and the counter 

15 43 input data into the memory 802 in accordance with 
addresses provided by the generator 80. As has been 
described previously, the counter 43 counts mail 
pieces, packages, and other forms of parcels and labels 
which pass by the matrix printer 36A for the imprinting 

20 of postage or other message. A mailpiece 22 is shown 
in phantom as it is moved past the head of the matrix 
printer 36A by the drum 40. The data stored in the 
memory 602 forms the message which is to be imprinted 
on the mailpiece 22. Other sources of data such as the 
25 weight .and serial number, described hereinabove, have 
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been deleted in Figure 3E to facilitate -the descrip- 
tion. The data stored in the memory B02 is applied to 
the coder 88 for the formation of the field of l*s and 
O'Sr which field is . stored -in the memory 804. . The 

5 . arrangement of the stored field is similar to that 
shown in the memory 92 of. Figure 3A, the stored field 
being larger in the memory- 804 to accommodate the larg- 
er array of the indicia of Figure 6.. 

The matrix printer 36A comprises a set of 

10 print points 96, as does .the printer 36 of Figure 3A, 
for printing a set of dots to form, each symbol of the 
indicia. The rows and, columns of the dots for each 
symbol are stored in the read-only memory 806, the dots 
of the respective rows being applied via corresponding 

15 ones of the switches 81.0 to. the respective print points 
96 of the printer 36A. The stored data in the RAM 802 
is applied to the ROM 806 as an address to select the 
sequence of symbols for which the ROM 806 is to supply 
the dots to. the printer 36A. Each of the switches 810, 

20 in addition to receiving the dots for a specific row of 
a symbol, also receives the dots from the RAM 804 for a 
specific row of the code. The speckling is accom- 
plished by momentarily operating individual ones of the 
switches 810 to substitute dots of the code for dots of 

25 the- field of a symbol. 
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The selection of the speckled regions differs with 
the various alphanumeric symbols, the locations and 
sizes of the speckled regions being chosen so as to 
retain legibility of the symbols as demonstrated in 

5 Figure 6. The ROM 808 stores the location of each 
pixel in each of the speckled regions for each symbol, 
and is addressed by the RAM 802 concurrently with the 
addressing of the ROM 806. Thereby, the speckle data 
and the symbol data for the imprinting of the complete 

10 message are available in the memories 808 and 806. 

In each switch 810, the AND gates 811-812 are 
connected to an output line of the memory 80S, the con- 
nection to the gate 812 being complemented to provide 
for alternate actuation of the gates 81 1—812 by output 

IS signals of the memory 808. The gate 811 connects with 
the code memory 804, and the gate 812 connects with the 
symbol memory 806. The output terminals of the gates 
811-812 are coupled via the OR gate 813 to the printer 
36A. Thereby, in response to a logic 0 outputted .from 

20 the speckle memory 808, dots of the symbol are printed, 
and in response to a logic 1 outputted from the speckle 
memory 808, dots of the code field are printed by the 
printer 36A. The drive unit 6 4 activates the three 
memories 804, 806 and 808 to output their respective 

25 signals concurrently with the operation of the drum 40, 
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such operation of the drive unit 64 conforming to the 
description presented above for the system of Figure 
3A, Thereby, the print system BOO of Figure 3E inter- 
leaves speckles of the code field with the printed 

5 indicia in a manner which preserves legibility of the 
message while permitting personnel utilizing the system 
BOO to observe the nature of the coding. 

The operation of the read system 650 of Fig- 
ure 4E parallels that of the read system 34 of Figure 

10 4A in that the received signals are first correlated 
against a reference to identify the received signals , 
after which identification specific portions of the 
indicia carrying elements of the code are compared 
against a regenerated replica of the code. The system 

15 850 includes the drum 40 , the drive unit 64, the timing 
unit 106, the coder 88, and the displays 52 and 54 
which were previously described with reference to Fig- 
ure 4A. Also included is a matrix photo sensor 46A for 
viewing the received indicia, the sensor 46A operating 

20 in a manner similar to that of the sensor 46 of Figure 
4A but having additional photo sensing elements for the 
enlarged dot-matrix format of the indicia printed by 
the system 800 on an object such as the package 22, 

The read system 850 further comprises address 

25 generators 852 and 854, RAM's 855, 8S6 and 857, 
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correlators 661-862, a memory 864, and gates 867-868. 
The arrangement of dots sensed by the sensor 46A is 
stored in the RAM 802 concurrently with an addressing 
of the RAM 802 by the drive unit 64 in synchronism with 
the operation of the drum 40 for positioning the. pack- 
age or mailpiece 22, A reference dot-matrix array for 
each symbol is stored in the memory 86 4 to be 'correlat- 
ed against the message symbols of the RAM 802 by the 
correlator 861. The correlation is based on the com- 
plete symbol field (Figure 6) minus the portions re- 
served for the speckled regions. Thereby, the symbols 
of the message can be accurately identified by the cor- 
relation process. 

In operation, upon attainment of a corre- 
lation, the correlator strobes the address generator 
854 to address the memories 857, 855 and 856 to store, 
respectively, the dot-matrix pattern of the received 
symbols from the BAM 802, the identify of the received 
symbol, a*d the pixel locations of the corresponding 
speckled regions. The latter is stored in the memory 
864 along with the dot-matrix patterns of the reference 
symbols. The symbols stored in the RAM 855 are output- 
ted to the display 52 so that personnel can read the 
message. 

Verification of the coded portions of the 
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message, so as to insure the integrity of the message, 
is accomplished as follows. The coder 88' is also cou- 
pled to the output terminal of the RAM 855 and/ upon 
receipt of data in the message, regenerates the code 

5 and stores the code field in the RAM 804. The code and 
symbol data stored in the RAM 857 , and the code data 
stored in' the RAM 804 are then read out via the gates 
867-868, respectively, to the' correlator 862. This 
reading out is accomplished under control of the ad- 

10 dress generator 852 which operates in response to tim- 
ing signals of the timing unit 106. The operation of 
the timing unit 106 has been described hereinabove. 
Thus, the generator 852 addresses the RAM's 857 and 804 
after the storage of their respective data has been 

15 completed. 

The generator S52 also addresses the RAM 856 
to activate the gates 867-868 to pass the respective 
output signals of the RAM's 857 and 804. Such ac- 
tivation occurs only within the designated regions for 
20 the speckling of the code, such data being stored in 
the RAM 856, Thereby, the correlator 862 is able to 
correlate the regions of the code field presented in 
the speckling with the corresponding reference regions 
of the code' field to verify that the received message 
25 is true. The correlator 862 then strobes the display 
54 to indicate the verification. 
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1. A device {32, 200, 400, 600, 800) for 
the metering of encrypted messages, such as postage and 
similar indicia characterized by: 

(a) an entry means (48) for the entry of data; 

(b) means (86, 90) coupled to said entry 
means (48) for the storage of said data; 

(c) an encryption circuit (88, 92) for de- 
veloping a code word; 

(d) means (36, 4 06) coupled to said storage 
means (86, 90) and to said encryption 
circuit (88, 9 2) for imprinting a bar- 
code representation of the data of said 
storage means and a code word (210) of 
said encryption circuit; 

(e> means (82, 94; 201, 208) synchronized 

with said imprinting and coupled between 
said storage means (86, 90) and said 
encryption circuit {88, 92) for alter- 



0132782 



nately feeding data of said storage: 
means (86, 9 0} and a code word of said 
encryption circuit (88, 92) to said im- 
printing means (36, 402). 

2. A device according to claim 1, 2 or 3 , 
characterized in that said imprinting includes a print- 
head (96) for imprinting marks on a printing medium (22) . 

3. A device according .to at least one of 
the preceding claims, characterized in that said entry 
means comprises a keyboard (48) and in that said keyboard 
{48) includes means (40, §4, 66) for moving the printing 
medium (22) passed said printhead (36) . 

4. A device according to at least one of the 
preceding claims, characterized in that said printing 
medium is a package (22) , said device further comprising 
timing means (42, 43) coupled to said moving means (66) 
for synchronizing said alternate feeding with the posi- 
tion of said package (22) . 

5. A system (20) for the printing (32, 200, 
400, 600, 800) of encrypted messages wherein the messages 
are printed in a bar-code format on a printing medium (22) 
characterized by: 
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(a) a keyboard (48) for the entry of data; 

lb) means {86, 90) coupled to said keyboard 
(48) for storing the data; 

(c) encryption means (88, 92; 202) responsive 
to the data for producing a code (210) 
derived from the data; 

(d) a bar-code printer (406) for printing a 
bar-code indicia on said medium; 

(e) means (82, 94; 201, 202, 208) coupled to 
said storage means (86, 90) for alter- 
nately driving said printer (4 06) with 
data from said keyboard (48) and with 
elements of the code of said encryption 
means (88, 92, 202) . 

6. A system (34, 420, 620, 850} for reading 
of encrypted messages according to claim 7, characterized by 



25 



(a) means (4 22) for reading said bar-code 
indicia on said medium; 
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(b) means (426, 88, 92, 201) coupled to said 
reading means (4 22) for regenerating 
said codes; 

(c) means (428) for comparing a code read by 
said reading means (4 22) with a code of 
said regenerating means (426, 88, 92, 201) 
for verification (54) of said bar-code 
indicia. 

7. A system according to claim 5 or 6, 
characterized in that said printer includes a printhead 
(96) and means (40, 64) for- moving said medium passed 
said printhead. 

8. A system according to at least one of the 
preceding claims 5 to 7, characterized in that said moving 
means (40, 64) includes means (4 2) responsive to positions 
of said medium (22) for synchronizing (43) said printer 
driving means (64) with the movement of said mediumi 

9. A system according to one of the preced- 
ing claims 5 to 8, characterized in that said reading 
means (34) includes a reading head for sensing indicia 
on said medium, means for translating said medium (22) 
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passed said reading head, and means (42) responsive to 
the position of said medium (22) for timing (106) said 
alternate driving means (64). 

10, a device for verifying the presence of 
encrypted material presented serially with data in a 
bar-code format printed on a printing medium wherein 
the encrypted material is derived from the data 
characterized fay; 



(a) means (422) for reading bar-code indicia 
on said printing medium (22); 

(b) means {426, 88, 92, 201) responsive to 
data read by said reading means (422) 
for generating the encrypted material; 
and 



(c) means (428, 54) for preparing the rege- 
nerated encryption material with a 
reading of such material by said read- 
ing means to verify the Indicia. 



11. A device according to claim 10, 
characterized by means (106, 64) synchronized with a 
reading by said reading means for moving the printed 
medium (*22) and a reading head of said reading means. 



0132782 




2/11 



0132782 





3/11 



01 32782 




4/11 




5/11 



0132782 




9/11 




8 

si- 
s' 

o 





2k 




I 




TIM1 
UNI 










E 




St 




g 









10/11 





32782 



" l«™p"»«»™ r 0154 972 

EuropeanPatentOff.ee © Publication number: ^ 

Office europeen d« brevets 

EUROPEAN PATENT APPLICATION 

@ mi. a«: G 07 D 7/00, G 07 B 1 7/00 



Application number: 8S1 02784.7 
Date of tiling: 12.03.86 



$ Priority ; 12.03.84 VS68B4M 


^ 0^,StamforiCwne^utO«M«(US) 


Date ol publication ot application: 18.09.85 
Bulletin 85/38 


<§» Inventor: Ectcert, Alton B., 79 TcllsomaAvanua, Korvwlfc. 
Conn, 06851 <US) 


@ Designated Contracting States: CHDEFRGBLI 


(5% Representative: Lehn.Wmwr.Olpt.-lns. at al, Hoffmann. 
Ettle & Partner Patentanwatte „„^, rt « , D « 



@ Htetbod and apparatu. tor verify** po*tag«. 

@ An indicia (10) having an encrypted mark (20} is stamp- 

code for authentication of such postage. 



OS 

© 

ID 




ACTOfHJM AS 



METHOD AND APPARATUS FOR VERIFYING POSTAGE 



10 



20 



25 



The present invention relates to a method and 
apparatus for verifying postage. 

Postage meters find extensive use throughout the 
world for imprinting postage on objects to be maxled. 
Postage, of course, is the amount of money or fee reared 
to have the Post Office deliver a mail piece to whxch the 
postage is applied to an indicated address. The pos age^ay 
L applied to a mail piece by a print head enclosed withxn 
the postage meter, i.e., directly upon an envelope or upon a 
Lei. «hen postage is printed upon a label, the 
then placed in adhering contact onto an envelope, parcel or 
other object to be mailed. The postage meter is also 
capable of printing information in addition to the amount of 
postage. For example, the postage meter is used *>r 
Imprinting the date of mailing, the piece number suitable 
indicia designating instructions and/or routing format on 
for transport by private carriers, and the like as xs well 
W». Furthermore, if desired, the postage meter can be 
utilized for the imprinting of yet other forms of labels 
such as tax stamps, assuming that governmental approval for 
such tax stamps is obtained. 

A potential problem in the use of imprinted postage 
is the attempt at fraudulent adulteration of such postage; 
whereby, in effect, the person adulterating the postage is 
stealing the value of the postage. A fraudulent .mpress.on 
may enable someone to obtain postage, or in the case of a 
tax stamp, to avoid paying the tax. The foregoing probl«. 
have been overcome by various methods of determining if the 
postage on a mail piece is genuine through various forms of 
encryption and apparatus have been designed to implement 
such methods . 
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The instant invention provides an advantageous method 
and apparatus for determining if the postage on a mail piece 
is genuine. The apparatus includes electronic circuitry for 
the development of an encrypted mark, and a printer which is 
driven by the electronic circuitry to imprint an indicia 
with both the postage and other information in combination 
with an encrypted mark. The encrypted mark may be in the 
form of alphanumeric characters or other printwork and may 
be used for verifying the postage. An important feature of 
the invention is that encryption derived from data on the 
mail piece such as the amount of postage, the date, and, if 
desired, the sender and other data; thereby, the data 
imprinted on the mail piece or label is related to the 
encrypted mark. In the event that the printed matter is 
altered, either the encrypted mark cannot be decoded or, if 
decoded, the postage will not agree with the encrypted mark 
imprinted on the mail piece. 

For a better understanding of the invention, and to 
show how the same may be carried into effect, reference will 
now be made, by way of example, to the accompanying drawings 
in which: 

Fig.- 1 shows a typical indicia imprinted by a postage 
meter upon a label, and 

Fig. 2 is a block aiagram describing the features of 
the invention. 

Referring now to Fig. 1, a standard indicia that is 
imprinted by a postage meter on a mail piece is shown 
generally at 10 . The indicia includes the amount of. postage 
12, a meter number 14 that identifies the postage meter that 
printed the indicia, the date 16 the postage is printed, the 
piece count 18, that indicates the number of times the 
postage meter has printed postage, and a code or encypte'a 
mark 20. In this embodiment, the encrypted mark 20 is in 
the form of numerics and is placed as if it were the least 
significant number of the piece count 18. It will be 



appreciated that the encrypted mar* 20 „a y be xn the for* o £ 
alphameric*, and that the encrypted »arX m ay be pl aced 
anywhere whether in the for, of nu^rics, alphanumerxcs or 
any similar type of mark. 

Coders for obtaining an encrypted mark 20 are well 
Known and may - * variety of systems such as that used^y 
the National Bureau of Standards based on the multiplication 
of pairs of large numbers. A coder that may be utilised in 
the instant invention for obtaining a seed number and a 
resulting encrypted mark is described in European Patent 
Z£Zo», £ .4 10. «*.. IDS Serial lo. 515,760 assigned 
to the assignee of this application) the disclosure of which 
is hereby incorporated by reference. 

in Fig. 2, a system is shown that may be utilized to 
5 validate the information shown in Fig. 1., and includes a 

decoder 22. This decoder may be a microprocessor such as an 
Intel model 8039. When there is a question as to the 
validity of the postage on a mail piece, a postal official 
or clerk, would input into the decoder 22 the postage amount 
20 12, the serial number 14, the date 16, the piece count 18 m 
any convenient manner. The decoder 22 would have resident 
therein the seed number generated by a coder. The decoder 
is utilized for decoding and performs an encryption 
^algorithm for determining the valid encryption mark based 
25 upon information supplied to the decoder. After P™ee"«* 
the input information, the valid mark would be supplied to 
the postal official, as for example, on a display. If the 
mark generated by the decode 20 corresponds to the number 
following the piece count, than the operator knows the 
postage is genuine. If there is no such match, then the 
postal official is aware of wrongdoing and can take 
appropriate action. 

As stated previously, the encrypted mark 20 may be 
placed at any appropriate part of the indicia in any 
convenient form. For example, the encrypted mark 20 could 
be a part of the postage meter number or it could stand 
alone. In any event, as long as a standard system is 
established in accordance with the teachings herein, the 
authenticity of postage may be verified. 
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CLAIMS : 

1 . A method of verifying postage through an 
encrypted mark (20) that is part of an indicia (10) 
applied to a mail piece, characterized by; 

providing a decoder (22) having a seed number 
5 stored in memory; 

inputting data selected from information of the 

indicia (10) ; 

deriving an encrypted message from the decoder 
based upon the stored seed number and input data; 
10 and 

comparing an encrypted message generated by the 
decoder (22) against the encrypted mark (20) on 
the mail piece. 

IS 2. A method according to claim 1 , 

characterized by the step of providing the postage fee 
(12) , the meter serial number (14) , the piece count (18) 
and the data (16) as part of the input data, 

20 3. Apparatus for verifying postage, 

characterized by: 

encryption means (22) for generating an encrypted 
mark (20) ; 

means for supplying information relating to data 
25 printed (10) on a mail piece to said encryption 

means (22) ; and 

means for indicating said encrypted mark. 

4 . Apparatus for verifying postage , 

30 characterized byi 

encryption means for generating an encrypted mark; 
means for supplying information relating to data 
printed on a mail piece to said encryption means; ai 
means for printing said encrypted mark on said mail 

35 piece. 



5. Apparatus according to claim 3 or 4, 
including means for generating- a seed number as part of 
said encryption means (22) . 
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® Franking system. 

<g> A method of franking mail items (10) is disclosed 
in which the franking impression includes a machine 
readable portion (12) and a visually readable portion 
(11) The machine readable portion (12) comprises a 
data bloc* including at least a postage charge and a 
pseudo-random number and the data block » en- 

Scrypted prior to printing. During printing of the fran- 
king impression, at least a part of the machine 
readable portion (12) is read (17) and compared with 
Nthe data block intended to be printed. If the compan- 
Jgson is satisfactory the printing operation » continued 
"to print the visually readable portion (11). The 
Epaeudo-random number is changed for 
SSansaction which may be each tern or batch of 
Hems, The machine readable portion « read at a 
© mail handling centre to provide an input to a postage 
(^charging and accounting function. 
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TW- invention relates to a method of franking 
pcstal .terns by which postal authorities are en- 
abled to account for charges relating to the nan 
cling cf mail items and to obtain payment for such 
Parses from the sender of the mall items. The 
invention also relates to franking apparatus for car- 
rying out the method. 

Currently used postage payment systems for 
franking machines fait into two categories. In one 
category, in which the postage * prepaid, the 
.ranking machine is constructed anc I operated to 
securely maintain a record of cred,t remaining 
available to a user of the machine and the machine 
is controlled to lock if and when the credit level 
decreases to a predefined low value. Conse- 
quently if this low credit level is reached and the 
rnach.ne locks, the machine is unable to be used 
for further franking until such time as payment has 
been received by the postal authority for addrtional 
credit ana the new credit value has been entered in 
the machine. In the other category in which a post 
payment method is used, the meter is read periodi- 
cally and the user invoiced accordingly, use of the 
franking machine is constrained by controls which 
: ock the machine when total postage value used 
exceeds a predetermined limit, in both of these 
categories of system it is necessary for the fran- 
king machine to incorporate security measures to 
prevent fraudulent use of the machine. In order to 
maintain the integrity of the security complex con- 
trcl systems are used in the interna* operation of 
the machine and the franking machine is con- 
structed to be physically robust and is provided 
with Waling devices to prevent unauthorised ac- 
cess to the interior of the machine. In addition to 
the security maintained in the franking machine 
the postal authorities operate an elaborate manual 
procedure for checking franked mail items which 
necessitates restriction of location at which franked 
mail cart be posted by any sender. The main- 
tenance of security in the franking machine in- 
creases the cost of the franking machine and this 
together with restrictive posting procedures tends 
to limit the use of franking machines to those users 
which have a relatively large volume of posts' "S" 

^Broadly the invention relates to a system of 
'ranking mail items comprising printing franking 
data in machine readable form on said mail items 
by senders of said items, said franking data includ- 
ing at least data relating to a postage charge for 
the item encoded in a secure manner to prevent 
unauthorised printing of said data relating to the 
postal charge and identification data; utilising a 
data reading device to read said jmprinted franking 



data from the mail items at a postal authority 
location to provide data signals relating to each 
mail item; utilising said data signals to generate a 
transaction record for each of the franked .terns 
s and utilising said transaction records to generate a 
billing account for each sender of franked mail 
items. . .. 

According to one aspect of the invention a 
method of franking mail items comprises the steps 
jo of generating a pseudo-random number relating to 
a franking transaction; forming a data block con- 
taining at least said pseudo random number and 
data relating to a postal charge for said mail item; 
encrypting said data block; printing data represent- 
« ing said encrypted data block together with iden- 
tification data in machine readable form on a mail 

ltem p r eferably a different pseudo random number 
is generated for each franking transaction. 
20 The franking data may be printed on the mail 
item in the form of a bar code consisting of spaced 
bar code marks of differing width. 

According to another aspect of the Invention a 
method of franking mail items and accounting lor 
25 postage value used comprises at a mail item fran- 
king location the steps of generating a pseudo- 
random number relating to a franking transaction; 
forming a data block containing at least said pseu- 
do random number and data relating to a postal 
30 charge for said mail Item; utilising an encryption 
key unique to a franking machine to encrypt said 
data block; printing data representing said encryp- 
ted data block together with data identifying said 
franking machine in machine readable form on a 
35 mail item; and at a postal authority tocat ion fte 
steps of machine reading said identification data 
and printed encrypted data block; selecting from a 
record of decryption keys a decryption key cor- 
responding to said identification data; utilising said 
* selected decryption key to decrypt said encrypted 
data block read from the mall Item: checking valid- 
ity of the pseudo-random number contained in said 
data block and if valid utilising the postage charge 
data as an accounting Input to account for postage 
4s value used. 

Preferably a record of pseudo random num- 
bers used In relation to a franking machine iden- 
tification is maintained; a pseudo random number 
read from franking data of a current mail item is 
compared with the record of pseudo random num- 
bers: and the franked mail item is accepted for 
despatch to a destination address only if said pseu- 
do random number is valid . 

In accordance with yet another aspect of the 
invention franking apparatus includes means to 



oenerate a pseudo random number to each ran- 
king transaction: means to form a data block by 
combining said pseudo random number with 
postal value selected for franking a mail .tern, end 
printing means operable to print tank.* • lata rv- 
eluding said data block in machine readable form 
on the mall item. . 

Preferably the franking apparatus includes 
means operable in combination with a secure en- 
cryption key to encrypt said data block. 

Preferably the franking apparatus includes 
reading means operative to read said 'tanking data 
printed in machine readable form on the mail item, 
and means operative to compare frankmg data 
intended to be printed with the franking data read 
by said reading device and to terminate franking in 
the event that the comparison means indicates an 
error in the printed franking data. 

The franking apparatus may include means op- 
erable to print a visually readable franking on the 
mail item only if the comparison means indicates 
that the printed franking data is free of error. 

A method of and apparatus for carrying out the 
invention will now be described by way of example 
with reference to the drawings in which:- 

Figure 1 shows a franking impression on a 

mail item . 

Figure 2 is a flow diagram of the operation of 
a franking machine 

Figure 3 is a flow diagram of procedures 
carried out at a postal authority centre and 

Figure 4 is a block diagram of franking ap- 
paratus. 

Referring first to Figure 1, a franking printed 
onto a mail item 10 comprises two parts indicated 
as 11 and 12. The part 11 consists of a typical 
franking such as is applied by current franking 
machines to enable visual inspection ot a mall item 
to ascertain that it has been correctly franked wtth 
a value of postage appropriate to the size or weight 
of the Item. the destination of the Item and the 
postal service such as surface mail or airmail re- 
quired by the sender. The franking consists of a 
predetermined pattern as governed by rules laid . 
down by the postal authority and usually includes 
not only the vaiue of postage but also the date of 
franking and the licence number of the franking 
machine. At the time of printing the franking addi- 
tional information such as a slogan 13 may be 
printed on the mail Kern alongside the franking, in 
addition ihe franking impression includes the por- 
tion 12 consisting of an impression in a coded form 
which can be read by machine. The coded impres- 
sion may take a number of forms, the form illus- 
trated consisting of a bar code in which data is 
represented in binary notation by spaced bars of 
ons or other of two widths. In printing the franking, 



it is usual for the mail item, an envelope in this 
present example, to be fed in a direction left to 
right as seen in Figure 1 in which the upper edge 

14 engages and is guided by a guide on the 
5 franking machine and the right hand edge 1 5 is the 

leading edge of the envelope. These edges 14 and 

15 of the mail item serve as datum edges for the 
positioning of the franking impression on the item. 
The bars of the bar code, in the portion 12 of the 

,o franking, extend transversely to the direction of 
feeding of the mail item and are spaced apart in 
the direction of feeding of the mail item. The por- 
tion 12 may consist of a single row of bars or 
where the quantity of data to be represented would 
,s require an unduly long row of bars, the data may 
be represented by bars arranged In a number of 
rows, for example two rows, as shown in Figure 1. 
It will be appreciated that instead of panting di- 
rectly onto the envelope, the mail item on which 
so printing is effected may comprise an adhesive label 
for subsequent application to an envelope or par- 
cel Conveniently, the franking may be printed by a 
thermal print head 16 (Figure 4) which has a plural- 
ity of print elements disposed along a line extend- 
J5 ing transversely to the direction of feeding of the 
mail item. The print elements are selectively ener- 
gised in synchronism with the feeding of the mail 
item in such a manner as to achieve printing of the 
required franking impression. Since the portion 12 
30 consisting of coded data is required to be read by 
machine it is desirable to check the printing of the 
bar code by a reading device 17 positioned up- 
stream and immediately ad|acent the print head. 
The data represented by the bar code in the por- 
35 tion 12 of the franking impression includes date of 
franking, postage value and franking machine iden- 
tification which conveniently may be the licence 
number of the franking machine, in addition it is 
preferred to include the despatch postal area code 
<o and the destination postal code. In order to ensure 
that the data, particularly that relating to the post- 
age value, is valid and is secure from attempts to 
fraudulently print or tamper with that data, the data 
Is formed into a secure code or data block. Tins is 
45 effected by causing the franking machine to gen- 
erate a pseudo random number and to combine 
mis with at teast the postal value to form a data 
block. This data block is then encrypted using a 
secure encryption key held in non-volatile memory 
so in the franking machine. The licence number of the 
franking machine and the despatch and destination 
areas codes are combined with the secure data 
block after encryption. The pseudo random num- 
bers are generated in a sequence so that succes- 
55 slve numbers of the sequence are used for each 
franking transaction. A franking transaction may 
comprise franking ot an individual mall item or may 
comprise franking of all mail items during a pre- 



determined time period, for example one day. 
Thus n the (after instance, the pseudo random 
number is reset for each day and this may be 
effected by an algorithm triggered by resetting the 
date in the franking machine. Thus the data b ock 
for each franking transaction is unique. As will be 
seen from Figure 4. the franking machine includes ■ 
eiectrcmc circuits 18 operable to control operation 
of the print head 16 and to receive output s.gnals 
from the reading device 17. Non-volatile memory 
19 is provided to store the licence number of the 
franking machine and any other data which may be 
required in the operation of the machine. The cir- 
cuits 18 are operable under the control of software 
programs to generate pseudo random numbers .n 
sequer.ce and to form a data block by combining a 
' postage charge value input on a keyboard 20, or 
from another source, and to utilise an encryption 
key heid in a secure location of memory 19 to 
encrypt the data block and then carry out a printing 
operation in which franking data including the en- 
cr/oted data block is printed in the form ot a bar 
code on the mail item fed past the print head 16. 

Figure 2 illustrates steps in the franking ma- 
rine operation from which it will be seen that after 
encryption of the data block, the portion 12 of the 
franking impression is printed and. immediately 
thereafter, .s read by the reading device. The out- 
put of the reading device is compared with the data 
block intended to be printed. If the comparison 
indicates that the printed bar code correctly repre- 
sents the data block, the operation of the franking 
machine continues so as to print the visually reada- 
ble portion 11 of the franking impression and the 
mail item 10 bearing a complete franking impres- 
sion 1 1 12 and. where desired, a slogan or the like 
13 is fed from the franking machine. However if the 
comparison indicates that the data block is not 
correctly represented by the printing, printing of 
the remainder of the franking impression is termi- 
nated and a fault message Is displayed on the 
franking machine: The output of the reading device 
in resoect of the whole of the portion 12 of the 
franking impression may be compared with the 
■whole cf the data block intended to be printed. 
However the processing of the data in the compan- 
ion operation may take a length of time such that a 
pause would be required before continuing after a 
correct comparison to print the visually readable 
portion 1 1 of the franking impression. In order to 
enable the printing of the entire franking impression 
to be continuous and uninterrupted, the comparison 
may be carried out on a probability basis and be in 
respect of only a leading part of the portion 12 of 
the franking impression. If a comparison in respect 
of this part of the portion 12 indicates that this part 
is correct, a decision would be made to continue 
printing and the visually readable portion would be 



printed immediately following printing of the ma- 
chine readable portion in a continuous printing op- 
eration. While such a partial comparison would not 
check the entire portion 12, on a probability basis, 

s if this part has been correctly printed by the print- 
ing device, the printing device will continue to 
function correctly to print the remainder of the 
portion 12 and the partial comparison will provide 
an adequate and sufficient check of the printing. 

,o The postage value and destination code are 
input to the franking machine by the user, or from 
another station in a mailing system of which the 
franking machine is a part. The date of franking 
may be set automatically from a clock device in 

,s the (ranking machine and the licence number is 
read from a location of non-volatile memory where 
it is stored. 

The licence numbers and corresponding users 
secure encryption keys are held in a data base 
so accessible by mail handling apparatus at a postal 
authority location, referring to Figure 3. when the 
(ranked mail item 10 is received at the postal 
authority location, it Is fed into an automatic mail 
handling apparatus. The apparatus includes a suit- 
as abie code reader for reading the bar code of the 
portion 12 of the franking impression. Upon reading 
the licence number from the portion 12 of the 
franking impression, the data base is accessed to 
obtain the secure encryption key associated with 
30 that licence number and the key is utilised to 
decrypt the secure data block represented by the 
bar code of portion 12 of the franking impression. 
Validation checks are carried out on the data within 
the block to check validity of the data. The validity 
as checks include a check to ensure that the data 
read from the secure block is error free, a check on 
the pseudo random number to ensure that it is a 
valid current pseudo random number, a check that 
the licence number of the machine relates to a 
ao current account with the p6stal authority and a 
check that the date and value of franking have 
allowable values. If the validation checks indicate 
that the coded franking impression is valid and 
acceptable by the postal authority the mail item is 
as fed for sorting and handling in the usual mariner. If 
the portion 12 of the (ranking impression includes 
destination data for the mail item, reading of this 
destination data by the code reader may be utilised 
to control mechanical sorting apparatus to direct 
so the mail item to an appropriate destination area bin. 
In the event that either the reading of the code 
portion 12 indicates a faulty reading of the data or 
the validity check on data in the secure data block 
indicates that the data is not valid. thB mail item is 
55 directed to a station where a manual check of the 
franking impression can be effected. If, from the 
manual check, the franking impression is judged to 
be valid the franking and destination details are 



entered manually at a keyboard term.™ and he 
Lm is re-introducsd into «w mechan.cal hand tog 
system. On the- other hand, if it appears that the 
franking impression is invalid and possibly results 
from an attempted fraudulent action, the mail .tern 
may be passed to a supervisor for attention The 
franking data read Irom the portion 12 of the fran- 
king impression and after decryption of the .secure 
data block, together with similar franking data en- 
tered manually on the keyboard terminal is unused 
to enter the postal charge for the mail item as a 
transaction on a computerised accounting system. 
Billing of users of the franking machines may be 
effected from the accounting system and in addi- 
tion reports concerning usage of the matt handling 
system may be produced for management and 
other purposes. 



Claims 

1 A method of franking mail items charac- 
terised by the steps of generating a pseudo-ran- 
dom number relating to a franking transaction; for- 
ming a data biock containing at least said pseudo 
random number and data relaling to a postal 
charge for said mail item; encrypting said data 
biock; printing data (12) representing said encryp- 
ted data block together with identification data in 
machine readable form on a mail item (10). 

2 A method as claimed in ciaim 1 further 
characterised by the steps of machine reading said 
printed data {12> from said mail item (10); compar- 
ing information obtained from reading said printed 
data block with information contained in said data 
block and in response to identity therebetween 
printing a visually readable franking impression (11) 
including at least a postage charge on the mail 
item. „ , 

3 A method as claimed in claim 2 further 
characterised in that the step of comparing is effec- 
ted in respect of only a part of the information 
obtained from reading said printed data block (12). 

4. A method as claimed In claim 2 further, 
characterised in that the step of comparing is effec- 
ted in respect of the whole of the information 
obtained from reading said printed data block (12). 

5 A method as claimed in any preceding claim 
further characterised by the step of generating for 
each of a series of franking transactions respec- 
tively a next pseudo-random number of a series of 
pseudo-random numbers. 

6. A method as claimed in claim 5 further 
characterised In that a franking transaction com- 
prises franking of a single mail item (10) and 
wherein the next pseudo-random number of the 
series is generated for the franking of each succes- 
sive mail item. 



7 A method as claimed in claim 5 further 
characterised in that a franking transaction com- 
prises franking of a batch comprising a plurality of 
mail items (10) and wherein the next pseudo-ran- 

s dom number of the series is generated for the 
franking of a first mail item of each successive 
batch of mail items. 

8 A method as claimed in claim 7 further 
characterised by the steps of registering a current 

,0 data and generating the next pseudo-random num- 
ber of the series in response to change in the 
registered date. 

9 A method of franking mail items and ac- 
counting for postage valye used characterised by. 

JS at a mail item franking location, the steps of gen- 
erating a pseudo-random number relating to a fran- 
king transaction; forming a data block containing at 
least said pseudo random number and data relating 
to a postal charge for said mail item: utilising an 
20 encryption key unique to a franking machine to 
encrypt said data block: printing data representing 
said encrypted data block together with data iden- 
tifying said franking machine in machine readable 
form (12) on a mail item (10); and. at a postal 
26 authority location, the steps of machine reading 
said Identification data and printed encrypted data 
block (12); selecting from a record of decryption 
keys a decryption key corresponding to said iden- 
tification data; utilising said selected decryption key 
3 a to decrypt said encrypted data block read from the 
mail item (10); checking validity of the pseudo- 
random number contained in said data block and if 
valid utilising the postage charge data as an ac- 
counting input to account for postage value used. 
3S 10 A method as claimed in claim 9 further 
characterised by the step, at the postal authority 
location, of maintaining a record of pseudo-random 
numbers used in franking mail items (10) at the 
franking location corresponding to the identification 
40 data; and comparing the pseudo-random number 
from the data block read from the mail item with 
pseudo-random numbers already used at that fran- 
king location and accepting the mall Item as validly 
franked if the pseudo-random number has not been 
is used. 

11. A method of franking a mail Item charac- 
terised by the steps of generating a different 
pseudo-random number for each franking transac- 
tion; printing on the mail item (10) franking data in 

so machine readable form (12), said franking data 
including a data block containing data relating to a 
postal charge for said item and the pseudo-random 
number applicable to that mail item, said data 
block being encrypted prior to printing on the mail 

55 item. . , , 

12. A method of handling a mail item franked 
by a method as claimed in any preceding claim 
characterised by the steps of utilising a reading 
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device '17) to read the franking data (12) printed 
on the mail item (I0)in machine readable form; 
ma-nta ; nitg a record of pseudo random numbers 
usee in relation to a franking machine identification: 
rcmparing a pseudo random number read from 
franking data of a current mail item with the record 
rf pseuco random numbers; accepting the franked 
mail item for despatch to a destination address 
only if said pseudo random number is not included 
in said record and adding the pseudo-random num- 
ber of the franking data of the current item to satd 
record cf pseudo-random numbers. 

13. Franking apparatus characterised by means 
(18| to generate a pseudo random number for each 
franking transaction; means (18) to form a data 
block by combining said pseudo random number 
with a postal value selected for franking a mail 
item; and printing means (16) operable to print 
franking data including said data block in machine 
readable form (12) on the mail item (10). 

14. Franking apparatus as claimed in claim 13 
further characterised by means (18) operable in 
combination with a secure encryption key to en- 
crypt said data block prior to printing on the mail 
itemftO). , 

15. Franking apparatus as claimed in claim u 
or 14 further characterised by reading means (17) 
operative to read said franking data printed in ma- 
chine readable form <12) on the mail item (10); and 
means <18) operative to compare franking data 
intended to be printed with the franking data read 
by said reading device (17) and to terminate fran- 
king in the event that the comparison indicates an 
error in the printed franking data. 

16. Franking apparatus as claimed in claim 15 
further characterised In that the printing means (16) 
is operative to print visually readable franking (11) 
on ;he mail item (10) only if the comparison in- 
dicates that the printed franking data (12) is free of 
error. , 

17. Franking apparatus as claimed in claim 1© 
further characterised In that the printing means (16) 
is operative to print a visually readable franking 
(11) including at least a visually readable postage 
value. 



so 



6 




READ 
VEHJ 



KO A NO 1 ^p/oiSPLAY FAiXT ) 

fy cooe 1 N0 — y 



PRINT FftANCHO 








CHECK 




REFER TO 
SUPEftYfSOft 




». MANUAL 








REJECT 


l_J 








ENTER OfiTAlLS 
ON TERMINAL 


fi 


ACCEPT 






Figure. 3 



DIALOG fR) File 351 : DERWENT WPI 
(c>1998 Derwent Info Ltd. All rt s . reserv, 
008727324 **i mage available- 
WPI Acc Mo: 91-231339/199132 
XRPX Acc No: N91-176343 

j^^r^z^t^^tr^^ d *" — — <«. 
"s&sr 1 -" -sssr™,™™ P0STMIA ^ 

Inventor: DIETRICH K 

ESS J^ trlMI 006 of Patents: 007 

Patent Ho Kind Da te Applet No Kind Date Main ipc 



DE 4003006 
EP 440021 
US 5186498 
EP 440021 
DE 4003006 
EP 440021 
DE 59103303 



19910801 DE 4003006 
A 19910807 EP 91100186 
A 19930216 US 91647442 
A3 19920122 EP 91100186 
C2 19930812 DE 4003006 
Bl 19941026 EP 91100186 
G 19941201 DE 503303 

EP 91100186 



19900130 
19910108 

19910129 B42D-015/00 
19910108 

19900130 G07B-017/04 
19910108 G07B-017/04 
19910108 G07E-017/04 
19910108 E 



Week 
199132 B 
199132 
199309 
199322 
199332 
199441 
199502 



2193468 '"1352, EP 352498; GB 2173741; GB 2193157; GB 

Patent Details: 

S'SSm^ L " P ' riU '• 3 Patent 
US SkS!' A St "~ <^"«l'= ™ DE « SB U 

DE 4003006 C2 4 
EP 440021 Bl G 5 

isiESrt stat,s ss-r>' c » » » « " 

EP 44 0021 

Abstract (Basic) : DE 4003005 A 

edification? d ldMtl f"«io„ i. p„, tM t.d a,«i Mt 

Dwg.1/2 

"S&TSSr S E f SgS,?"-""' ■™* »™.. ^ 

Derwent Class: P76; T01; T05 
International Patent class (Main): 
File Segment: EPI; EngPi 



B42D-015/00; G07B-017/04 



Europaisches Patentanrt 
European Patent Office 
Office europgen des brevets 



■luniiuHii 

© Publication number: 0 526 1 66 A2 



EUROPEAN PATENT APPLICATION 



© Application number: 9230668X7 
© Date of filing: 28.07,92 



> int. CiA G06F 15/42 



<§> Priority: 29.07.91 US 737351 

@ Date of publication of application: 
03.02.93 Bufletln 93/05 

© Designated Contracting States: 
AT BE CH DE FR 6B LI NL S£ 



© Applicant: Dessertine, Albert L. 
53 Park Avenue 

Flemlnglon, New Jersey 08822(US) 

© Inventor: Dessertine, Albert L, 
53 Park Avenue 

Flemfngton, Mew Jersey 08822{US) 

© Representative; Ablewhite, Alan James 
MARKS & CLERK 57/60 Lincoln's Inn Fields 
London WC2A 3LSIGB) 



IX) 

O a 

Q. 
LU 



© Patient compliance monitoring method and system. 

© The present invention is directed to a method of itc 
monitoring a patient's medicine compliance. It in- 
volves utilizing an automatic compliance monitoring 
device which tracks patient compliance data, along 
with a wave energy transmitter and power source, all 
connected to a medicine container. A receiver' is 
connected to a computer with a display unit. The 
compfrance monitoring device or the computer is 
program msd to calculate compliance requirements 
of the container e.g. by number of cap openings, by 
dispensing count or by weight information obtained 
by the aulomalic compliance monitoring device, for 
each dosage administration for the prescription pe- 
riod. The wave energy transmitter on. the medicine 
container continuously, periodically, or randomly 
transmils raw or calculated data to ihe receiver and 
from there to the computer to compare actual usage 
with compliance required, to determine compliance 
results on Ihe display unit to permit compliance 
monitoring on a monitor at a remote location. Option- 
ally, other patient characteristics are also monitored 
and feedback is provided. The present invention 
includes both Ihe method and the syslem or inter- 
connected devices to practice the method as well, as 
a single component which includes in combinalion, 
the medicine container, compliance device, transmit- 
ter and power source. Feedback may be to any 
professional or any rem He localion, and a -ng| e 
medicine or a plurality . " isdicines may tie mon- 
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The present invention is directed to a method, 
system and component for monitoring a patient's 
compliance with a medicine regimen. It is directed 
to compliance monitoring by another person other 
than the patient, such as a relative or a professional 
such as a pharmacist, doctor, hospital, clinic or the 
like, at a location remote from the patient. The 
present invention involves the use of one or more 
automated compliance monitoring devices, wave 
energy transmitters, remote receivers and comput- 
ers for monitoring and optionally includes monitor- 
. ing of other patient status information such as 
physical characteristics, e.g. hoart rate, btood pres- 
sure, etc. and/or treatment program compliance 
such as physical therapy or exercise regimens. 

The use of precision, automatic compliance 
monitoring devices, unique programming and re- 
mote radio transmission of data directly from the 
medicine containers to computers and linking pe- 
ripherals to monitor medicine regimen compliance ■ 
has not been taught in the prior art. 

U.S. Pat. No. 4,577.710 issued to Edward 
Ruzumno is directed to an apparatus for promoting 
good health which involves a personal weight scale 
and an information and message center which may 2 
be used merely for weight control or may be used 
for specific messages pertaining to a health con- 
dition with pre-taped feedback Iron a physician. 
This recently issued patent represents the concept 
of patient weight monitoring for genera! or specific 3, 
health purposes. However, it does not pertain to 
medicine regimen compliance, automatic compli- 
ance monitoring devices or computer linking as in 
the-^esent invention. 

Most recently, Time Magazine , June 5, 1069, 3. 
at page 70 reported that Aprex, a California Com- 
pany has developed a cap for use with medication 
containers. A computer chip in the cap records the 
day and time" each time the cap is opened (for 
taking medicine). The professional, e.g. the doctor 40 
will, at a later time or visit, put the cap into an 
electronic analyzer that lets the user know how 
regularly the medicine was taken. This automatic 
compliance monitoring system, unfortunately, does 
not permit the doctor or pharmacy to monitor un- 
less the cap is delivered to the anafyzer. 

U.S. Patent No. 4,899.639 issued to Dessertine 
and Hudson and assigned commonly to Ihe as- 
signee herein, describes a compliance system us- 
ing a scale tied into a computer for weighing medl- sd 
cine containers and calculating usage, and, there- 
fore, compliance, at specific or random times dur- 
ing a prescription period. This system requires the 
patient to physically place the medicine container 
on a scale and possibly perform other tasks related 5S 
thereto. 

U.S. Patent No. 5,016,172 to the inventor here- 
in, Desstrtine, and commonly assigned, describes 



compliance monitoring systems where the medi- 
cine container has a device for tracking (collecting, 
storing, retrieving) compliance data, and (hen input- 
ting same by connecting the container to a com- 
5 puter. for compliance monitoring. Again,' this re- 
quires some action on the part of the patient,- e.g. 
plugging the computer and container together. 

The present invention uniquely enables doc- 
tors, hospitals, pharmacies, manufacturers, data 
w centers, etc. to monitor compliance from remote 
locations without requiring the patient to take any 
specific action not needed In the absence of com- 
pliance. In other words, ihe present Invention is the 
first patient passive compliance monitoring method 
5 and system that provides Un* opportunity for on- 
going feedback/information on the patient's compli- 
ance activity. 

The present invention is directed to a method 
of monitoring a patient's medicine compliance, K 
0 involves utilizing art automatic compliance monitor- 
ing device which tracks patient compliance data, 
along with a transmitter and power source, all corh 
nected to a medicine container. A receiver is con- 
nected to a computer with a display unit. The 
compliance monitoring device or the computer is 
programmed to calculate compliance requirements 
of the container e.g. by number of cap openings, 
by dispensing count, by light band or intensity 
measurement, by weight information obtained by 
the automatic compliance monitoring device or the 
like, for each dosage administration for the pre- 
scription period. The radio transmitter on the medi- 
cine container continuously, periodically, or ran- 
domly transmits raw or calculated data to the re- 
ceiver and from there to the computer to compare 
actual usage with compliance required, to deter- 
mine compliance results on the display unit to 
permit compliance monitoring on a monitor at a 
remote location. Optionally, other patient character- 
istics are also monitored and feedback is provided. 
The present invention includes both Ihe method 
and the system of interconnected devices to prac- 
tice the method as welt as a single component 
which includes In combination, the medicine con- 
tainer, compliance device, transmitter and power 
source. Feedback may be to any professional or 
any remote location, and a single medicine or a 
plurality of medicines may be monitored. 

The present invention, its advantages and ob- 
jects will be more fully understood when the speci- 
fication herein is taken in conjunction with the 
drawings appended hereto, wherein: 

Figure 1 illustrates a diagrammatic representa- 
tion of some preferred embodiments of Ihe 
present invention; 

Figure 2 illustrates an alternative embodiment 
diagrammatic representation of the present in- 
vention; 
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Figure 3 Illustrates a schematic diagram of the 
presenl invention showing (he Interrelationships 
of the various components; and, 
Figure 4 shows an alternative embodiment sche- 
matic diagram of the present invention. 
The present invention involves a method and a 
system for monitoring a patient's compliance with 
regard to adhering to a particular medicine regimen 
as well as a specific component involved in the 
system. It is directed to compliance monitoring by 
someone at a remote location, e.g. a relative or 
friend or paid service or by a professional such as 
a pharmacist, a doctor, a physical therapist, a 
chiropractor or the like or by a hospital or clinic or 
staff of a convalescence home or a remote data 
collection center, a government agency or other 
party or any combination of these. Thus, the 
present invention involves remote monitoring in- 
dependent from the patient. Further, the invention 
involves using one or more automatic compliance 
monitoring devices, wave energy transmission, e.g. 
radio transmission, from the medicine container to 
a receiver and then, directly or indirectly, to one or 
more computers which are interconnected. In some 
embodiments the receiver may be located within 
the computer or attached integrally to it. In addition 
to medicine regimen, optional status of patient 
health characteristics may be monitored with com- 
puter tracking, feedback and other communication. 
Thus, a patient's heart rate, blood pressure, glu- ; 
cose level, cholesterol level, weight or other phys- 
ical characteristics may be monitored or some 
compliance with a physical therapy program or 
\sxercise program may be monitored in addition to 
the medicine regimen monitoring. 3 

By "medicine container" used herein is meant 
any portable container which may be carried by a 
patient and has a plurality of dosages of medicine. 
The medicine itself may be liquid, slurry, cream, 
paste, powder, capsule, caplet, tablet or any other 4, 
dosage capable form. The medicine container will 
necessarily have a cap portion and a base portion. 
The "cap portion" may be a fully removable cap, a 
connected cap such as a hinged cap, or merely the 
door of an orifice. The "base portion" is the con- u 
tainer minus the cap portion and is that part which 
holds the medicine. 

The "automatic compliance monitoring device" 
described herein is meant to be any known or to 
be developed device connected to a medicine con- st 
tainer - pill, capsule, liquid or otherwise - which 
tracks (recognizes and stores) data pertaining lo 
actual medicine consumption or container usage. 
"Actual medicine consumption" means actual 
amount of medicine taken from a medicine con- 55 
tainer. Such devices may include cap opening 
counting devices such as the Aprex device de- 
scribed in the prior ar< above, or automatic pill 



counting devices or light band-based or light 
intensity-based contents measuring devices or 
weight or volume tracking devices connected to a 
container, ft may be an optical scanner which mea- 
s sures volume or fill level or il may be another 
container-attached or attachable device. The details 
of the workings of such devices are now within the 
skill of the artisan and variations may be made 
wilhout exceeding the scope of (he invention. 
o The "transmitter" herein is a wave energy 
Iransmitter such as a radio or microwave transmit- 
ter, although no frequency limit to the transmission 
is intended. It has a power source for transmitting 
and may be capable of transmitting onty short 
} distances or long dislances depending upon costs 
and purpose. For example, a transmitter in a medi- 
cine container for a hospital patient may need only 
a very short transmission with receivers in every 
room, on every floor or centrally located. Or, the 
> user may have a transmitter at home or at work. 
The transmitter may be set up to transmit continu- 
ously, periodically or randomly, e.g in response to 
a stimulus. The iransmitter may send unique iden- 
tifiers and then compliance data, e.g. social secu- 
rity number of patient, medication code and pills 
removed , or weight, or fill level. The power source 
may be the same as one running the compliance 
device and may be, e.g. solar chargeable. 

The receiver used may be any which wili per- 
form the function of receiving the data transmitted 
and forwarding it. The receiver may, for example, 
(a.) forward the data directly to one or more 
computers: 

(b.) pass the data through telephone lines or 
cable television lines to one or more data receiv- 
ing computers at a more remote location; 
(c.) pass the data to an amplifier, second trans- 
mitter where it may be retransmitted to a remote 
receiver directly or even via satellite to a re- 
gional, national or international dala canter; 
(d.) simulcast the daia by any or all of Ihe above 
or any other available methods to diverse re- 
ceivers, including conversion of data from radio 
to electronic, digital, sonic, optical or printed 
format; 

(e.) in addition to, or separate from, any of the 
above, forward compliance or non-compliance 
information to a computer with a displayed mes- 
sage, e.g. with audio signal, to the patient to 
advise the patient to take some corrective action 
as needed. Likewise, unique computer display 
of problem compliance to a doctor, hospital, 
agency, etc. may be effectuated by the present 
invention method. 

Referring now to Figure 1, there is shown a 
flow diagram with steps (A), (B) and (C) shown 
which involve preparing the system for using the 
method of the present invention as well as steps 1 
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through 4 which show an embodiment involving the 
steps of the present invention. Thus, frame 2 
shows step (A) wherein an automatic compliance 
monitoring device, a wave energy transmitter, e.g. 
radio transmitter, and power source are attached to 
a medicine container. The frequency of the wave 
energy transmitter is not critical as tang as the 
wave energy is sent and received in useable form. 
Low, high, ultrahigh, microwave, C-band, Ku-band 
or any available frequency may be used. 

Frame 4 indicates in step (B) that, separately, a 
receiver, computer and display unit are provided. 
Thus, any automatic compliance monitoring device 
which Is capable of accurately, electronically deter- 
mining or recognizing medicine consumption 
and/or container usage data and recording and 
storing same is adapted for transmitting information 
to a receiver and computer. The computer may be 
active or passive, I.e. do significant work with the 
data or simpty convert it so it may be transmitted 
to and displayed on a remote display unit. Thus, 
for example, the device may be used to generate a 
signal which, after transmission and reception, may 
he amplified and then converted from analog to 
digital using a state of the art analog digital con- 
verter and inert the signal would be used to per- 
form compliance calculations on the computer. Ad- 
ditionally, frame 6 of Figure 1 , step (C) involves the 
pre-programming of the device or the computer to 
store prescription requirements, to recognize var- 
ious information such as indicated and to deter- 
mine or calculate compliance requirements and to 
compare these to actual data. The system may 
involve storing sequential information e,g. dosage 
frequency data, so as to determine a required 
regimen and to compare actual usage against the 
required usage on a periodic basis or at random 
times, and to provide feedback. Having thus pre- 
programmed the device and/or the computer to 
perform these functions as well as optional func- 
tions described below, the system may now be 
used to practice the method of the present inven- 
tion. 

Referring again to Figure 1 , frame 8 shows the 
first step (1) wherein data produced by an auto- 
matic compliance monitoring device from a medi- 
cine container is transmitted to said receiver and 
computer at least from time to time. As used 
herein, "from lime to time" may be after each 
dosage is taken or at set Intervals or at random 
Intervals. Transmission could, alternatively, be con- 
tinuous. Frame 10 shows the second step wherein 
the device or computer performs the functions pre- 
programmed per step (C), frame 6, discussed 
above. The computer recognizes the difference be- 
tween the actual data and the dosage requirements 
of a patient after it calculates ttie required usage 
based on the dosage amount and frequency. 



Frame 12 shows the third step wherein a remote 
display unit receives the results of the compliance 
comparison, and frame 14 shows the fourth step 
wherein the computer displays compliance results 
5 for patient monitoring at a remote location. 

As can be seen, the computer used in the 
present invention may be any conventional com- 
puter system and may be interlinked by way of 
modem or radio transmission or any oiher com- 
10 puter finking possibilities. 

Figure 2 illustrates another diagrammatic repre- 
sentation of a present invention system. Here, like 
frames to Figure 1 are like numbered and are 
Identically described. In this embodiment, however, 
is as shown in frame 16, step (C) calls for providing 
an amplifier, second transmitter and second re- 
ceiver. In frame 18, programming is as in frame 6 
of Figure 1 . 

In the first step (1) shown in frame 20 of Figure 
eo 2, the data is transmitted, received, amplified and 
re-transmilted to a second receiver and then to one 
or more computers. Thus, a small, battery powered 
transmitter may transmit data lo a remote but local 
receiver, which may then boost lira data by am- 
25 plilyrng same and re-transmittlng to another re- 
ceiver and Ihen to one or more computers. Steps 
(2), (3). and (4) shown by Irames 22, 24 and 26 of 
Figure 2 illustrate the same steps, (2), (3) and (4) 
as shown in Figure 1. 
30 Referring now to Figure 3, there Is shown a 
component 1 having an automatic compliance 
monitoring device, radio transmitter, power source 
and medicine container. The device provides data 
to the transmitter in radio transmission form and 
35 this is transmitted to receiver/computer 3 which is 
In turn connected to remole display unit 9. Addi- 
tionally, receiver/computer 3 is connected lo an 
optional, remote computer for professional or hos- 
pital use shown as 7 and when utilized this is 
M connected to remote display unit 9. Optionally, 
inputs on other patient data may be fed into 
receiver/computer 3 and these optional inputs are 
shown as block 11. Also, optional patient display 
unit 5 may be connected to the system for auto- 
es matic feedback and/or instructions from a profes- 
sional who is monitoring the patient's medicine 
regimen. Further if a professional or hospital is 
monitoring patient's medicine regimen, then com- 
puter 7 and remote display unit 9 may be intercon- 
so nected with a plurality of other patient inputs 13 
and thus professionals may sequentially or ran- 
domly monitor a plurality of patients with the same 
system. This may be beneficial for convalescent 
homes, cancer treatment' centers, rehabilitation 
55 centers and the like where patient progress and 
medicine regimen may be monitored from a single 
computer station, as well as lo other data collection 
enters. 
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Figure 4 illustrates another schematic diagram 
of an alternative embodiment of the present inven- 
tion. Most of the block frames shown are the same 
as those shown in Figure 3 and lite parts are like 
numbered. However, in this embodiment, the trans- 
mitter from component 1 sends data to component 
2 which includes a receiver, amplifier and re-trans- 
mitter. The re-transmitter forwards data by trans- 
mitting to component 3. For example, component 2 
may be located in a home, in a hospitaf room, at a 
radio tower or close to or a significant distance 
from component 1 depending upon the power of 
the component 1 transmitter. Subsequent functions 
are similar to those described in conjunction with 
Figure 3 above. 

An optional feature Involves the use of satellite 
reception and re-transmission shown as component 
4 in Figure 4. In other words, the transmitter on the 
medicine container may transmit to a booster 
transmitter which may then transmit to a$ many 
receiver re-transmitter set ups as desired, with ap- 
propriate amplification as needed. 

in one preferred embodiment of the present 
invention, the medicine laker or user of the system 
may trigger an automatic transmission upon open- 
ing the container to input with the device and the 
computer each time the medicine is laken. Thus, in 
this embodiment, the expression relating to provid- 
ing input from the device to transmit to the receiver 
and the computer "from time to time" refers to 
each time it is used. In this manner, optimum 
monitoring is achieved so that if there is an over- 
dosage or a missed dosage, the present invention 
system will alert (he user, or a professional or both 
of the deficiency or overdosage. Additionally, the 
system may, as mentioned, be used to provide 
monitoring for more than one medication at a time. 
This may be done by including an optional iden- 
tifier whereby the compliance monitoring device for 
each medication has a code which Js transmitted 
with the compliance data and read by and properly 
identified by the computer before the computer 
calculates and compares actual and required dos- 
ages. Alternatively, other ways of discerning advice 
for one medication from another may be included 
without exceeding the scope of the present inven- 
tion. 

In another preferred embodiment of the present 
invention, the system is used to also monitor heart 
rate, blood pressure, glucose, cholesterol, blood 
cell count, respiration, body weight or other phys- 
ical characteristic or characteristics and these may 
be monitored by the patient or by a professional. 
Further, or in addition to the foregoing, the system 
may be used to also monitor compliance with a 
physical regimen such as a physical exercise pro- 
gra i or a physical therapy program. This may be 
done by having q user active system wherein ihe 



user must feed in information to a transmitter for 
transmission to the receiver and the computer each 
time an exercise or a therapy session occurs or. 
more preferably, the system itself may be interJin- 
5 ked with actual exercise equipment such as tread- 
mills, exercise bicycles, rowing machines; weight 
pulls, etc. and direct Information from Ihe exercise 
equipment will be communicated to the computer 
via one or more transmitters and receivers) and 
io subsequently to the monitor to assure compliance 
by the patient. 

fn any of the above embodiments, the present 
invention in its more refined embodiment may in- 
clude computer recognition and feedback of actual 
ib times and dates for every required dosage {specific 
day and/or time of day) and for every actual dos- 
age removed from the medicine container, tn other 
words, the system will provide the patient and/or 
professional with output showing actual versus re- 
20 quired usage on a time based dosage comparison. 
When this mode is utilized, the computer will be 
provided with necessary information to generate 
requirements and the patient may input ihe com- 
puter with data from the compliance monitoring 
25 device of Ihe medicine container at each use of the 
medicine container. 

While the computer described above is gen- 
erally preprogrammed to receive data from the 
automatic compliance monitoring device radio 
30 transmission and to process that data, the com- 
puter may be more complex or Jess complex with- 
out exceeding the scope of the present invention. 
For example the computer may be merely a unit 
that reads electronic information provided to it and 
as converts it for transmission to a display unit Alter- 
natively, the computer may include any or all of the 
previously mentioned comparison and reporting 
functions and optional functions any may also in- 
clude means tor a patient to provide subjective 
40 information back to a hospital or doctor such as 
how the patient feels or how the patient is respond- 
ing to the medication. 

Obviously, numerous modifications and vari- 
ations of the present invention are possible in tight 
45 of the above teachings. It is therefore understood 
that within the scope ol the appended claims, the 
invention may be practiced otherwise than as spe- 
cifically described herein. 

so Claims 

1. A method of monitoring a patient's medicine 
compliance which comprises: 

(a) providing an automatic compliance mon- 
ss itoring device, which device automatically 

tracks at least one type of patient medicine 
compliance data, said device being con- 
nected to a medicine container; 
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(b) providing a wave energy transmitter and 
a power source to drive said transmitter for 
transmission of said patient medicine com- 
pliance data to a remote location, said 
transmitter being electronically connected to s 
said automatic compliance monitoring de- 
vice for said transmission and said data 
transmitter and power source being con- 
nected to said medicine container; 

(c) providing a receiver at said remote ioca- to 
tion and providing a computer to which said 
receiver inputs patient medicine compliance 
data; 

(d) at least from time to time, transmitting 
patient medicine compliance data from said 15 
transmitter to said receiver and computer; 

(e) having either said device or said com- 
puter programmed to store the prescribed 
medicine dosage and regimen of said con- 
tainer, so 

(f) having either said device or said com- 
puter programmed to calculate compliance 
requirements for each dosage administra- 
tion for the prescription period of the medi- 
cine and for comparing the actual medicine is 
consumption or container usage with the 
compliance requirements; 

(g) connecting said computer to a display 
unit at a remote location away from the 
automatic compliance monitoring device; so 
and, 

(h) visually displaying the compliance re- 
sults or> said display unit to permit complj- 

'<■ ance monitoring. 

35 

2. The method of claim 1 wherein two computers 
are used, a first computer being located so as 
to be readily available to receive raw data from 
said automatic compliance monitoring device 

and a second being remotely located with said 40 
display unit. 

3. The method of claim 2 wherein said first com- 
puter includes a display unit to provide correc- 
tive instructions to a patient when appropriate. 45 

4. The method of claim 3 wherein said first com- 
puter is programmed to provide specific day 
and/or time of day information to display com- 
pliance information to a patient on its display so 
unit. 

5. The method of any of claims 1 to 4 wherein 
said transmission is to a professional for com- 
pliance monitoring. 65 

6. The method of any of claims 1 to 5 wherein 
the method is repeated for a pfurality of dif- 



ferent containers of medicine with different 
automatic compliance monitoring devices and 
the computer determines and stores compli- 
ance information for each of said plurality of 
different devices. 

7. The method of any of claims 1 to 6 wherein 
said automatic compliance monitoring device, 
said radio transmitter and said power source 
are located in a cap portion of a medicine 
container. 

8. The method of claim 7 wherein said automatic 
compliance monitoring device is a cap removal 
counting device. 

9. The method of claim 7 wherein said said auto- 
matic compliance monitoring device is a 
weighing device. 

10. The method of and of claims 1 to 6 wherein 
said automatic compliance monitoring device, 
said radio transmitter and said power source 
are located In a base portion of 3 medicine 
container. 

11. The method of claim 10 wherein said auto- 
matic compliance monitoring device includes 
an optical scale feature to measure medicine 
container content. 

12. The method of any of claims to 1 to 11 
wherein said receiver is located in a first re- 
mote area from said device and said computer 
is located at a second remote area from said 
device and said receiver and computer are 
connected to one another by additional wave 
energy transmission.. 

13. A system for patient medicine compliance and 
patient status monitoring, which comprises: 

(a) a medicine container having a cap por- 
tion and a base portion; 

(b) at least one automatic compliance moni- 
toring device which automatically tracks at 
least one type of data related to actual 
medicine consumption or container usage, 
said device being connected to a medicine 
container; 

(c) a wave energy transmitter and power 
source for transmission of patient medicine 
compliance data, said transmitter being 
electron ically connected to said automatic 
compliance monitoring device and said 
transmitter and power source being con- 
nected to said medicine container; 

(d) a receiver at a remote location from said 
radio transmitter; 
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(e> a computer connected to said receiver 
to receive input therefrom on patient medi- 
cine compliance data; 
. (0 a display unit connected lo said com- 
puter lo permit patient medicine compliance s 
monitoring; 

Further, wherein either said ctevlce or 
said computer is programmed to store pre- 
scribed medicine dosage and regimen of w 
said container and having either said device 
or said computer programmed lo calculate 
compliance requirements for each dosage 
administration for the prescription period 
and for comparing the actual medicine con- is 
sumption or container usage with the corn- 
plaince requirements to display comparison 
results on said remote display unit. 

14. A patient medicine compliance system compo- to 
nent, which comprises: 

(a) a medicine container having a cap por- 
tion and a base portion; 

(b) an automatic compliance monitoring de- 
vice which atuoamticaJly tracks al least one 25 
type of patient medicine compliance data 

and being connected to said medicine con- 
tainer; 

(c) a wave energy transmitter and power 
source to drive the transmitter for fransmis- 30 
sion of said patient medicine compliance 
data to a remote location, the transmitter 
being electronically connected to said auto- 
matic compliance monitoring device and the 
transmitter and power source being con- 35 
nected to said medicine container. 
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CLAIMS 



[ClaimCs)] 

[Claim I] Had the transmitter/central computer which transmits the code message received by the television 
set while a TV program is going on. It is a safety system in the remote participation to an interactive game. A 
TV viewer Read the broadcast message, have the possible game machine of returning the reply to the 
question made in these messages, and it sets to this system. It has a means by which a game machine counts 
a continuous period. Among these, the first period Clrl2) The message transmitted by the 
transmitter/central computer begins. The last period (Tr25) The connection with a transmitter/central 
computer from a game machine is completed. The first period It is prescribed by the time amount (tl) by 
which a message is received, and the time amount (t2) which a TV viewer answers. The last period (Tr2f>) It 
is prescribed by the time amount (t2) which a TV viewer answers, and the time amount (t5) by which a reply 
is sent to a transmitterfcentral computer. Further a game machine It has a means for transmitting a reply to 
a transmitter/central computer with the above-mentioned count result. The period when a 
transmitter/central computer is specified by the time amount (15) to which the term (t3) of a reply and the 
reply were sent (ta35), A means to count the period (tal5) specified by the time amount (tJ) to which the 
message was transmitted, and the time amount (t5) to which the reply has been sent, Tr25>Ta35 And 
relation called the value of TV12+Tr25=Tal5** tolerance is checked. The safety system in the remote 
participation to an interactive game characterized by having the count and the check means which are 
constituted so that a reply may be refused, when this relation furthermore is not verified. 
[Claim 2] The safety system in the remote participation to the interactive game ac(»rdmg to claim 1 
characterized by the count means of a game machine being constituted by the secured microprocessor which 
vperfbrms a clock pulse count program, and which is controlled by the clock. 
[Claim 3] The safety system in the remote participation to the interactive game according to claim 1 
characterized by constituting the count means of a game machine by count means controlled by the internal 
clock to perform a clock pulse count program. 

[Claim 4j By the means for receiving the digital information which is a machine for participating in a 
program and attesting participation in cooperation with a remote central computer, and is sent from a 
central computer, and the participant The interface means for introducing the data element showing a 
participant's participation, The means for connecting with a central computer, a microprocessor and at least 
one secured electronic component equipped with the storage means, and at least one clock signal generating 
circuit are offered. The above-mentioned machine by time amount Tl If the digital message wjbMi has a 
predetermined gestalt is received, the microprocessor secured after delivery and verification by the 
microprocessor which had that message secured will record this message on that memory. The count of the 
time amount unit proportional to the period of the clock signal given by the clock signal generating circuit is 
started. By time amount T2 If a machine receives the data element about his participation from the TV 
viewer who owns this machine A machine transmits the data element to the secured microprocessor. With a 
means by which this microprocessor records that data into that memory with a required gestalt, records this 
instantaneous time amount counted value further, and connects with time amount T5, until the 
above-mentioned machine is connected with a central computer Shortly after the secured microprocessor 
continues a count and connection is made A microprocessor transmits the data element and counted value 
Trl2 and Tr25 about the memorized participation. The machine for participating in a program with which a 
central computer is characterized by refusing a reply in verifying that these values are in agreement with 
the counted value of itself and not being further in agreement. 



[Claim 5l The machine for participating in the program according to claim 4 characterized by having had the 
chip card reading means and the chip card, and equipping the above-mentioned chip card with the 
component with which the gestalt of the integrated'circuit chip card which has a microprocessor, activity 
memory, and program memory was secured, 

[Claim 6] It is central computer equipment which manages the participation to the broadcast scenario of foe 
TV viewer who has an electronic participating machine. Atime amount count means, A means to broadcast a 
digital message to each electronic participating machine, and the means for making connection with each 
electronic participating machine, If it has the storage processing means and a new broadcast scenario is 
started lb time amount Tl, this central computer equipment uses a suitable transmission channel, and 
broadcasts a digital message at each electronic participating machine of a TV viewer. Furthermore, initialize 
a time amount count means, operate it, and a TV viewer memorizes time amount counted value to 
predetermined time amount T3 chosen as time amount it becomes impossible to participate in a scenario 
more than it. this -- a count - continuing - an electron - participation - a machine " a central computer -- 
connecting - having time amount -• ****** - choosing - having had "time amount ~ T - five ~ an electron 
- participation " a machine - obtaining - having had - time amount - counted value " memorizing - the 
following - relation - checking - * - Tr - 25 - > -• Ta - 35 - Tr25 is a count period by the electronic 
participating machine between T2 and T5 here, a Trl2-tTr25=Tal5** tolerance value - Trl2 is equipment 
which is a count period by the electronic participating machine between Tl and T2, and Tr35 is a count 
period by T3 and the central computer between T5, and is characterized by Trl5 being a count period by the 
central computer between Tl and T5. 



DETAILED DESCKTPTION 



[Detailed Description of the Invention] 
[0001] 

[Industrial Application] This invention relates to the unjust prevention system or safety system in 
remoteness or long-distance participation to an interactive game which verifies the time series of an event. 
[0002] 

[Description of the Prior Art] lb enable participation to a viewer's game which is called for so that a viewer 
. may answer for example, during broadcast to the question broadcast with I station ] the advent of the 
so-called interactive television systems is desired. In order for a TV viewer to answer in the midst of such a 
game after the correct answer of a game is shown from an office, or to prevent a various-subjects lexicon and 
answering after referring to the reference database of arbitration in addition to this, the maximum reply 
time amount must be set up. Furthermore, in order that the feeders (a cable operator, broadcast studio, etc.) 
of service may avoid "being saturated" by the reply of thousands sent to coincidence, as for a reply of a TV 
viewer, it is desirable to make it not sent immediately. For that purpose, an are recording transmitting 
system is indispensable. In this system, it is a. safe approach, and a reply of a TV viewer is memorized by the ■ 
devices for the public (for example, a cable decoder, the game machine of dedication, etc.), and behind, it is 
that viewer's home and it is sent [ it shifts time amount suitably and ] by the suitable telecommunication 
means of a radiotelephone and other arbitration I a cable and ]. 

[0003] There are some which were developed for example, developed by the interactive game networks 
(Interactive Game Networks) company as an example of such a system in the United States of America. In 
this system, a TV viewer has the small game machine with which a radio interface, the key board, the screen, 
the modem, and the security module were prepared. In order to understand actuation of such a system, 
please refer to drawing 1 which showed the time series of an event. 

[0004] By time amount Tl, a question is broadcast from the transmitter/central computer called a "central 
computer" below. These questions are broadcast with radio to the above-mentioned game machine- For 
example, at the time of initiation of a game of football, a TV viewer is called for so that the score of the first 
half may be expected. This question appears on the screen of a game machine. Arepry is inputted through 
the key boat of a game machine by each TV viewer who has participated in time amount T2, and it is 
recorded on the insurance chip (thing of the type currently used by the smart card) with which the game 



machine is equipped. A new broadcast signal locks all game machines in time amount T3, and it is made not 
to receive any replies any more to it after I of since a question is performed ] several minutes. Then, the 
answer to a question is broadcast by time amount T four Gn this example, T four is actually equivalent to 
halftone). Then, the reply recorded on time amount T5 is sent to the central computer of a game through an 
exchange type telephone network by the modem, and serves as certification of participation. If a TV viewer 
answers correctly, he/she will receive a certain prize thru/or prize. 

[0005] American ****** According to a practice like [ of No. 4,592,546 ] a publication, the date (time amount) 
of each event is recorded using the clock circuit which has sufficient precision installed in the game machine. 
When a reply of a participant is sent to the central computer of a game, the time amount recorded with the 
game machine is also sent to a central computer, and it is compared with the conventional' time saved in it by 
the computer. 

[0006] According to the practice otherwise proposed, in each public mold game machine, the reference clock 
signal transmitted &»m the central computer of a game and the electronic real time clock circuit 
synchronized for every feed spacing (for example, wireless association) possess. The time amount Tl it is 
broadcast that a question is, and the time amount T2 by which a reply is made are recorded on a game 
machine (for example, recorded in the chip for smart cards by the secured approach). If connection is made to 
a game central computer, the time amount recorded as the reply will be spent as certification of participation. 
A central computer is within the limits which can permit the information concerning air time Tl, and checks 
that T2 is a front [ T3 / which is a reply term ]. 
[0007] 

tProblem(s) to be Solved by the Invention] In addition to this in the above-mentioned system, the user who 
had malice in the similar embodiment may record the control signals (a question, a locking instruction, clock 
synchronization signal, etc) sent to bis game machine on a suitable machine. 

[0008] In that case, if the answer to a question is broadcast from an office or a special search or the place 
which he gets to know with the means of arbitration in addition to this comes when slightly behind, the 
individual with this malice can repeat a control signal in his own game machine, and can pretend the reply 
of real time. This becomes possible for the time amount of die length appropriate always enough passing 
before attainment of the reply to the central computer which a witness does not break into the individual 
who performs a fraud action in the privacy of a bouse, but is further expected from a degree from play 
termination. It is economically impossible to equip a game machine with the means for getting to know 
whether it is what slight delay is given, after a game machine is generated truly at the real time or the signal 
(this should be made by insurance) which it received from the outside is recorded completely without 
correction in them on it after all. 

[0009] the France patent application 89th - it applies as No. 06848 - having ■■ the France patent application 
public presentation official report 2nd - the patent exhibited as 647 619 No. - and - coming out ■- the France 
patent application public presentation ****** the France addition patent 90th exhibited as 2 658 357 No. ~ 
delaying a play to No. 01512 -■ the system which enables unjust prevention is indicated. Time amount (or 
reply term) T3 it was broadcast for the central computer in the system that an answer was, The reply by the 
TV viewer counts the absolute time which passes between the time amount T5 sent to the central computer, 
and it sets to time amount T2. By reply of a TV viewer, local time count actuation within a game machine is 
started. To the time amount T5 by which information is sent to a central computer, it checks that this central 
computer is size more nearly rightly than absolute time T5-T3 which itself calculated [ time amount T5-T2 
measured with the game machine of ******** J. 

[0010] The timing chart shown in drawing 2 shows the above sequence. The approach proposed by this 
patent is not trustworthy by any means to a regrettable thing. A user is because it can show between a reply 
and connection with a central computer as if time amount T5T2 [ longer than the time amount which 
actually passed ] passed by advancing a local time counter. This becomes possible only by correcting 
temporarily the oscillation frequency of the electronic clock circuit placed into the game machine. 
[0011] The counter in a game machine is actually accessible for a user, unless it is protected physically (i.e., 
unless it is embedded in resin). Even if this circuit is supplied by any of an RC oscillator, a ceramic resonator 
mold oscillator, or a crystal oscillator, that original frequency can be distorted by few I an oscillating 
component ] mismatches. Therefore, it is possible to make an oscillation frequency high by few percentages, 



01* to make it late, without being accompanied by exceptional difficulty. By making high the oscillation 
frequency of the oscillator supplied to the clock circuit of a game machine, the oscillation frequency of the 
oscillator of a game machine is made high waiting (it is waiting about an answer being broadcast live), and 
after that, and they can regain delay until term T3 passes over those who are going to perform a fraud action. 
Therefore, when this individual's game machine receives an mqiiiry from a central computer by time 
amount T5, time amount T5-T2 of the appearance given to this central computer become long actually more 
rather. 

[0012] The method of equipping the microprocessor of a micxc<arcuit card of a certain kind with the clock 
frequency detector for detecting the abnormalities of a clock frequency is learned. In order for the individual 
who is going to perform for example, a fraud action to prevent trying the "step-by-step" method to the 
program performed by the processor, this kind of detector operates, when the clock frequency supplied to this 
component is extremely low. such [ typically ] a low frequency detector *■ the nominal frequency of the 
component - 1MHz - 5MHz it is - sometimes, it operates by less than about 500kHz. Serious lack of the 
precision in this kind of detector and the feet of existing only in order that it may detect an extremely low 
frequency mean that it cannot use it in order to prevent injustice above type. 

f0O13] This invention aims at conquering the fault of the system by which current use is carried out. The 
system set as the object of this invention can actually be used, in order that a TV viewer may verify certainly 
rightfy the fact ofhaving replied to the question between the terms determined by the transmitting person of 
time amount and a game to whom the question was given. 
[0014] 

[Means for Solving the Problem] The message secured using the code in which the first spacing is 
transmitted by the transmitter begins [ the system proposed here counting the time interval which continues 
by the secured processor (for example, microcircuit card processor) ], and the last spacing is ended by making 
connection with a central computer from a game machine, in order to send the certification of a reply to a 
central computer. 

[0015] More, a detail will be provided with the safety system equipped with the transmitter/central computer 
which transmits the code message received by the television set during advance of a TV program in the 
remote participation to an interactive game, if based on this invention. A TV viewer reads the broadcast 
message and it has the possible game machine of returning the reply to the question made in these messages. 
The die length Tr 12 of the period when a game machine is specified in this system by the time amount tl by 
\ which a message is received, and the time amount t2 which a TV viewer answers, It has a means to count 
the die length Tr2G of the period specified by the time amount t2 which a TV viewer answers, and the time 
amount t5 by which a reply is sent to a transmitter/central computer, and is [0016], The die length ta35 of 
the period when a transmitter/central computer is specified by the time amount t5 to which the term t3 of a 
reply and the reply were sent, It has a means to count the die length tal5 of the period specified by the time 
amount tl to which the message was transmitted, and the time amount t5 to which the reply has been sent 
Furthermore, relation called the value of Tr25>Ta35 and Trl2+Tr25=<rkl5** tolerance was checked, and 
when this relation is not verified further, it has a count means to refuse a reply. The count means of a game 
machine is constituted by the secured microprocessor which performs a clock pulse count program and 
which was controlled by the clock. 

[0017] The machine for according to this invention, participating in a program and attesting participation in 
cooperation with a remote central computer further By means to receive the digital information sent from a 
central computer, and the participant The interface for mtroducmg the data element showing a participant's 
participation, It has the means for connecting with a central computer, a microprocessor and at least one 
secured electronic component equipped with the storage means, and at least one clock signal generating 
circuit, and is [0018]. If a machine receives the digital message which has a gestalt predetermined by time 
amount Tl The microprocessor secured after delivery and verification by the microprocessor which had that 
message secured records this message on that memory. The count of the time amount unit proportional to 
the period of the clock signal given by the clock signal generating circuit is started. By time amount T2 When 
a machine receives the data element about his participation from the TV viewer who owns this machine, a 
machine That data element is transmitted to the secured microprocessor, this microprocessor records that 
data into that memory with a required gestalt, and records this instantaneous time amount counted value 



farther, and it is [0019]. Shortly after the secured microprocessor continues a count and connection is made 
W time amount T5 until the machine is connected with a central computer by the means which connects, a 
microprocessor transmits the data element and counted value Trl2 and Tr25 about the memorized 
participation, a central computer verifies that these values are in agreement with the counted value of itself, 
and a reply can be refused when not farther in agreement. 

[0020] Furthermore, the central computer equipment which manages the participation to the broadcast 
scenario of the TV viewer who has an electronic participating machine according to this invention is 
equipped with the time amount count means, a means to broadcast a digital message to each electronic 
participating machine, the means for making connection with each electronic participating machine, and the 
storage processing means, and is [0021]. If a broadcast scenario is started, to time amount Tl, this central 
computer equipment will use a suitable transmission channel, and will broadcast a digital message at each 
electronic participating machine of a TV viewer. And initialize a time amount count means, operate it and an 
audience memorizes time amount counted value to predetermined time amount T3 chosen as time amount it 
becomes impossible to participate hi a scenario more than it. : which continues this count, memorizes the 
time amount counted value obtained by the electronic participating machine to the time amount T5 chosen 
as time amount by which an electronic participating machine is connected to a central computer, and checks 
the following relation [0022] Tr25>Ta35 and a Trl2+Tr25=Tal5** tolerance value - Trl2 is a count period by 
the electronic participating machine between Tl and T2, TV25 is a count period by the electronic 
participating machine between T2 and T5 here, and Trl5 is [Tr35 is a count period by T3 and the central 
computer between T5, and ] a count period by the central computer between Tl and T5. 
[0023] Each game machine (electronic participating machine) is equipped with the microprocessor from 
which it secured for microcircuit cards. According to another example, this microcireuit may he contained in 
the card which has a gestalt like the card of a bank inserted in the machine which functions as a card reader 
of an available class commercially. Or in addition to this, the secured circuit may be built in portable goods 
other than a card, for example, the key of plastics, arid the goods of arbitration considered to be suitable. 
[0024] The secured circuit can also be directly installed to the main circuit component of a machine, as it 
demounted, and it mentioned above further, when it was thought that it is not necessary to suppose that it is 
possible. Please understand the word "secured microprocessor" to be what shows the microprocessor to 
which the protection of arbitration used for use of a smart card like the banking card which for example, the 
current bank has distributed is applied. By the Mowing publications performed with reference to attached 
^drawing, the advantage of others of this invention will become clear. The following publications are the 
things for instantiation only, and do not limit this invention. 

[00251 ^X. u, 

(Example] Drawing of drawing 4 shows the secured system in the participation to a game which enables 

measurement actuation of the sequence stated to the Mowing shown in Table 1 of the tail of this 

specification. This system has a transmitter / central computer 1 equipped with the central computer unit 20 

which it is combined with the TV program transmitter 10 and its transmitter 10, for example, can transmit a 

game message to the above-mentioned patent application with an enciphered gestalt like a publication. 

[0026] The transmitter/central computer is connected to the receiver arranged at user ** through the 

transmission means 30. The user who expects participation of the game broadcast reads the coded message 

receiving on a plane, and owns the game machines Ll-Ln connectable with the central computer in a 

standard approach. Time amount [ the time amount Tl to which a message is transmitted ], Le„ when a TV 

viewer is asked, a transmitting center and the game central computer 1 send the message of a code which 

signed game machines Ll-Ln, for example by the well-known secret key for card actuation. 

[0027] The transmission channel 30 which is a DCH of the dedication prepared in the channel (a channel of 

FM radio like [ For example, ] U.S.'s interactive game networks) of the inside of the same channel as the 

signal broadcast (for example, inside of a return frame), the channel (for example, HP channel of dedication 

on the cable which transmits two or more television channels) which it became independent of in the same 

medium, or a different medium can perform dispatch of this message. 

[0028] A DCH does not need to be the thing of the one direction nature from the transmitter and service 
provider of a signal to a TV viewer. A game machine LI will be sent to the secured component CS which 
demounted this so that it might explain to the following in a game machine, and was installed in the possible 



medium, if this signal that appears on the screen 41 of a television set 40 in the form of a code is received, A 
game machine can equip the above-mentioned patent with the -well-known type eleetromc-cireuitiy 
component like a publication, and a game machine can send a reply message to a central computer in 
response to the message which appears in the screen of television by it. 

[0029] It is shown in drawing 5 and the secured component CS is volatility and nonvolatile memory 110, i.e., 
RAM activity memory, and the ROM program memory 120. And EEPROM data memory 130 
Microprocessor 100 which it had It has. Component CS - clock signal generator 150 of a game machine from 
- a clock pulse ~ winning popularity - further - block 140 It has a connecting means to the game machine 
which expressed. It is a microprocessor 100 'when a message appears on a screen. That truth is verified by 
the usual approach and the activation of a time amount count subprogram based on a clock pulse is made to 
start in response to this message. This subprogram is contained in the ROM memory 120. 
[0030] Clock frequency 150 by which the secured microprocessor is actually supplied to the microprocessor 
instead of absolute time A proportional time amount unit is counted. It is because a microprocessor does not 
have time criteria other than this clock signal at all. Furthermore, secured microprocessor 100 That 
nonvolatile memory EEPROM130 The code message (or shadow of this message) which made count 
actuation start is recorded. 

[0031] In order to understand the following things more clearly, please refer to Table 1 of the tail of this 
specification. Microprocessor 100 from which this reply was secured when the TV viewer replied to the 
question by time amount T2 using his game machine LI It is sent and is a microprocessor 100. It is the 
well-known volatile memory 130 about it. It records and the time amount counted value which had reached 
further when the reply of a user was received is recorded. Microprocessor 100 secured just behind this event 
A count is continued. It does not change T3 that it is the absolute term which a TV viewer can answer to a 
question. Nothing happens to this time amount specialty at a game machine. That is, information is not 
received but the secured microprocessor continues the count of time amount. 

[0032] The central computer itself equipped with the standard processing means 20 containing the 
central-process unit 21 and memory 22 (the count program is loaded to one of them) by time amount TB 
starts time amount count actuation* A central computer is a core, and since it is used as criteria, it calls this 
count a count "absolutely" below. The count adopted shall be very stable and shall express the approximation 
near the real time as much as possible. T four is absolute time amount by which the answer to a question is 
given on a TV viewer's screen. Nothing special happens to this time amount. 

v [0033] A transfer of the specific data element of each TV viewer who participated in the game is performed by 
connecting game machines 40-40n to a central computer 1 after time amount T four (for example, several 
hours after a game). Since many TV viewers may have participated, probably connection is programmed to 
be carried out at night. The thing and direction which were used for a TV viewer's game machine 
broadcasting the DCH described previously are connected to a central computer through opposite "return 
channel." This return channel may be directly formed on a distribution cable, if television ia broadcast by the 
bidirectional cable. A return channel can also be set up on the switched telephone network with an easy 
modem. In addition, use of a possible return channel can be considered. The reference number 30 in drawing 
4 expresses one or more possible traj^mission channels of being equipped. 

[0034] Microprocessor 100 subsequently secured when connection was made by one of the above-mentioned 
means between the central computer 1 and a TV viewer's game machine LI (Ln) A standard justification 
rertification activity is started, the justification of a central computer is proved, and the justification of itself 
is proved with a central computer. The device of this justification certification shall be based on the code 
system using a secret key or a well-known public key, without completely changing the purpose of this 
invention. Microprocessor 100 secured during connection The value of the reply which was given to the 
central computer by the TV viewer and recorded on it by time amount T2 is sent. 

[0035] At this invention, it is a microprocessor 100. The value of Trl2 and Tr25 is further sent to a central 
computer. Here, Trl2 is the relative local time calculated in a TV viewer's game machine by the 
microprocessor secured between Tl and T2 (it is shown in drawing 3 like). Tr25 is the relative local time 
calculated by the secured same microprocessor between T (as [ show / in drawing 3 ])2, and T5. It is 
transmitted with the checksum which used the code and the value of the time amount which the reply of a 
TV viewer and the game machine Ll calculated on that spot can also be enciphered by well-known arbitrary 



encryption algorithms from the reasons of secrecy depending on the case, in order to guarantee the integrity. 
This does not influence the principle of this invention at all. 

S computer between T (a, [ show / in d^gj 3)1, and T5, by which Ta35 was calcukted with the 
Antral computer ^ongTS ™thT3 (as [ show/in d^a^ 

id on this invention, a central computer will check that it isTr25>Ta3o first m that case and it wiU 
check that it is a Trl2+Tr25^Tal5** tolerance value (the tolerance value is set up beforehand). A reply will 
beacceptediftheserelationisve^ t , , 

[0037] That is, it is the clock 150 given to a card between T2 and T5 in order for him to make the value of 
Tr25 increase artificially, if the individual who is going to perform a fraud action is going to show as it 
answered before T3 although he answered in practice after T3. Afrequeney must be raised. However, since 
the sum total ofTrl2+Tr25 stops becoming equal to a Ta 15** tolerance value, this actuataon will be revealed. 
[0038] Although activation is difficult, the still possible only malfeasance lowers only a part equal to the 
amount and accuracy which must raise the frequency of the clock signal' between T2 and T5, m order that 
the sum total of Trl2+Tr25 may maintain the legal value for the frequency of the clock signal given to the 
microprocessor secured between Tl and T2. In order to make this impossible, time amount T3 should just 
check that it is adjustable to time amount Tl (that is, what is necessary is just to make it, in order to reply to 
a question (the time amount which a viewer is allowed differ for every question)). Therefore, since the 
mdividual who is going to perform a fraud action does not understand the value which must raise the 
frequency of the dock signal between T2 and T5 continuously, he cannot foreknow the value which can lower 
the frequency of a clock signal between Tl and T2. 

[0039] It is also possible to guarantee events Tl and T2, T3, and the exact time series of T5 by the secured 
microprocessor which is used by the approach standard as an object for smart cards by this invention, and 
does not have the exact reference clock signal with which especially itself is secured by it. 
[0040] The component which drawing 6 shows the specific example in this invention, and was secured takes 
thegestaltofthemtegratedcMtcHpofamemorycardC.Thatis, in order that this machine may read the 
message displayed on the screen and may input a TV viewer's response, it has the part Ll used for 
connection with a central computer, and the memory card which demounted and was equipped with the 
possible part, i.e„ a microprocessor. For this reason, a part Ll is suited with the sbtF&rLl to receive a card 
and the connector C of a card, and there is a connector which enables Ll to function as a memory card reader 
^(not shown) in it. If it carries out with this example, especially this invention is applicable to the subscriber 
television systems which have already used the smart card, in order to secure the security to scramble 
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DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[Drawing ll It is the timing chart showing the time series of the event of a game. 

[Drawing 2l It is the same timing; chart as drawing 1 showing the count sequence by the Prior art. 

[Drawing 3] It is the same timing chart as drawing 1 showing the count sequence of this invention. 

[Drawing 4) It is drawing having shown the principle of a game system. 

[Drawing 5] It is detailed drawing of a safety system by this invention, 

(Drawing 61 It is drawing of the machine in a specific example. 

[Description of Notations] 

1 ... Game central computer 



10 ...Transmitter 

20 ... Central computer unit 

21 CPU ... Central-process unit 

22 ... Memory 

30 ... Transmission channel 

40 or 40n ... Television, set 

41 ... Screen 

100 ... Microprocessor 

110 ... RAM Activity Memory 

120 ... ROM Program Memory 

130 ... EEPROM Data Memory 

140 ... Connecting Means 

150 ... Clock Signal Generator 

CS ... Secured component 

C... Memory card 

F...Slot 

LI, Ln ... Game machine 



* NOTICES* 

JP0 and NGIPI are not responsible for any 
danages caused by the use of this translation. 

I/This document has been translated by computer. So the translation may not reflect the original precisely. 
2.**** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 
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{Drawing 6] 
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<© A medical measuring apparatus whloh wiaWaa a person to be fnsfteoted, such bb patients end pregnant 
women and an attandent'or the like, to perform a variety of medloal maaaufehiente at home or the !lk* ( the 
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ranulta, In accordance with the condition ol a dteaate, phyatral condition and oonslllullon of an Indlvlttust person 
to a» Inepeolad. otroumstencas or the Ilka, arid to execute Judgment torlhe m»HBuremapi results (n aooowtanoe 
wltli the eatortlarlona or the Ilka and output Oflrnmanta aiut execute commands, imtf a psraorvto fee InSpeotad to 
uses these' comment* and Ilia rasulls of ownrMnide, In eaoardancm with the measurements reaiilte. 
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TBOHNIOAl, FIKI.D 

The pmm invemton relates lo a medical measurement apparatus for allowing not only mediae! marts 
but also patients, pregnant women end ihslr attendant! or helper* to readily perform medloal measurement 

p fit medloel Mtuttonv or elsewhere (e,g„ a! fiame). More partlou.iarJy, the Inveiittan relates to n medloal 
moB«u(emBst apparatus wWch pormlta h«Bllh«oare or medlenl exerts euch astfontore to Identity the subject 
euoh as a patient or a pmQtiM woman and to sot appropriate comment* about that aubjeot with respect to 
relevant moasurlnB Iteme, to (he criteria tor Judgment «ntt to the measured results, the comment* being 
utilised by 'the subject depending on the measured resulls, 

10 The medical measurement apparatus ot thfe mvenllon allows madloal measurement to tie matte by 
patient* or pregnant woman themselves aa wall as by their attenttente or helpers. As a matter ot 
eonvenlenoe, the epBOlllOstlon hereunder will refer to the patient, pregnant woman, eto. from whom to 
collect specimens as "(he aubjaot," and the person operating the Inventive medical measurement apparatus 
• tor measuring the coitepted specimens es "the operator." The aubjeol and the operator may or may not be 

is ihs earns person. 

BACKGROUND ART 

a targe number of medical measurement systems and apparatuses have been developed for eaey use 
a> by the pallenle, pregnant woman w their attendants carrying out varloua kinds ot medloal measurement on 

their own. the measurements fnoluda euoh Items «« blood pressure, urine euaar tsve], urine protein and 

oooufl bloott, SB well as pregnancy teste and observation of mothers' conditions. 

Many of the convention*! leyotems end epparatusBB utilize teat liquids end test paper, in operation, suoh 

testing agents require visually Inspecting the change (n wler tone dependent of the amount of Ihs target 
n analyte detected In -epsolmene, whereby the measurements are determined, 

Recent yeare have seen th» advent of many other eppBratosee ihat convert en opfloejiy measured color 

, tone changa Into eleoTrtOe) signals or turn 1ha target analyte amount oanaentraVon) In the speolmen Into 

aleeWoal signals; The adnata thus obtained are used ae tlw baele for computing meaeuremenle that are 

displayed numerically andfcr Graphically on a display <inlt free Japanese Patent* Leld'Open Noe. Me el- 
se B3B44,8hoe3'8lie7,«tit,), 

■ Some madlael measurement eyateme performing et«olrio«l measurement store measured results In the. 

past on a number of occasions and allow them to be retrieved later end displayed «e needed to make more 

aoourate rhedloal measurement and diagnosis. Other systems oomprlss a. meohMsm that Generates err 

alarm If the measuring oondltlona auoh ae temperature and the target analyte concentration In the epeolmen 
55 are not appropriate [eee Japanese Patents Laid-open Nob, Brio 63*16/040, 8ho W -475W, efoj, 

Japanese Patent Utd-Open Ho, HbI fl.2808Bt discloses a body temperature data management eyetem 

comprising a cllnloel thermomelar equipped wild en LED. When the UED on the oltnlnal thermometer bffnke 

to Generate digital signals representing ft«ty temperature measurements ot the aub)Bot on a time eerie* 

baele, the eyetem properly read* the optical signals to have the body temperature data transferred thereto 
40 In a cord-free environment. The body temperature delft to stored along with ID Information on the sub] sot 

and the time stumps of measurement, to foe displayed later graphically or otherwise on a display unit. 

, The majority of the ooiwantlonel medtosl measurement eyeteme end oppanttuaoe have their measuring 
. itofre ttadly determined beforehand, and numeirfoally display eueh dlveree meaeuremente aa urlno euoar 

level and Wood pressure, The lodgment on In* mBBBuied results l» oiitrosted to (he operator (I*. eubjeot) 
is who may have no'spaofetlzed httowled(fe of the field in question. 

fipms eyateme have the ability to Judge and IncUoate that e particular measurement (e excessively htgh 

or low (toe taroe, too email, etc.) relative to the relevant standard range (see Japanese Patent Lald*Opan 

No. fiho 61-730B8), However, euoh Jutfflments are set gene/ietly tor all- subjects; judgments tallorad to 

Individual subjects oannot be performed* 
w tf the medloal measurement eyaterrw wllh a meanurement storage feature measure fmlevant eubjeots 

or perform measurement under ftully ambient oondltlane, euoh moasurememe ore still stored unchecked. 

When vlawed later by dootore and other experts, totally Irrelevant measurements oan be taken at valid 

ellnioal data, whtah oan result in miedlagnosle. 

The epove'dted body temperature data management system dlteioted fn Japanese Patent laid-open 
sa No. Hsl he» ihs funotton of managing bwfy temperatur* dtta based on ihs ID Informailon about 

epoolllo eubjeots, This eyatem, too, elmply maaaures body temperatures and etores the measHremMte In o. 

IlKOd mariner. The eyslem has no capability tor making appropriate and line-tuned judgments tallorod to 

Individual subjects on the baele of their body temperature data. 
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In rsoent yesra. various (Dims of remotely provided medfeal cere (generally called homo eare> have 
been On the rise. In particular, pallente with ohroillo dleeaeee or In the ohronlo stage of (heir disorders ere 
©Ken lakon oare of at home and not In the hospital, wild ft view to Improving the quality of life for the 
pattenla, For example, patients who we bedridden dueio cerebral disorders or beoeuee of their advanced 

« ages, patients ttllh ohronlo nephritis, diabetes, cancer, coronary end hep*1lo disorders, Infertile women, and 
pregnant women aw fit to receive home oare, These home-oare of BBlf-manaetng pallente live oulelde 
m;M institutions tntt thus require more adequate end rigorous supervision by doctors and olher experts 
then In-pellants, The home-oaw patients are apt to become anxious About their oondlllons, and the doctors 
and experts In charge of these patients era required to spend much mora time on them 1hen ok bvpallente 

io In terme of remotely coitttuotect examination end consultations by telephone. Because of the current 
constraints on ins number Of doctors and experts end on the facilities Available for home cere, there Is en 
urgent need for mudloal care management technology for twlng Individual pallente efficiently, appropriately 
end In art individually customized manner. 
- The conventional techniques eve capable of managing a large number of patients jit a fixed manner, but 

ts are incapable of establishing or modifying ttio measuring oondlltone, the criteria for Judgment, or cor- 
responding remedies and freatmenie fa r individual petlents. Because important Judgmente are left for the 
pattern to make, It (8 difficult for the experts managing ihe eyatem to deal Willi sudden changes In the 
patient's conditions qulekly and adequately.' Allhounh there exist means of communication and data trawler 
' system? whioh the ticptbre or experts may use to manage end transfer the moaeurod date on paUenle in 

so remote tonHltone, the fact remains that the doctors or experts In charge must keep constant surveillance 
over the date on nunwoue patients. Despite the oMoeted feolllllee end human resouroes, the patients ere 
unable to feel reassured that they are adequately token oare of bused on their meaeurei) results. The 
means and flyetems tor communicating and tranefening moaeured data between remote looetlons ere 
apparently effective In redwing the number of tlmsB each patient vlelte the hosplral or the number of times 

hi the pallent Is personally examined by the doctor. However, what these fuclHfle? tnn do Is simply to replace 
the hospital visits or the examinations In hospital with Iranefere of date or Judgments on Ihote data remotely 
made. There have yet to be solutions to the problems of how to reassure both Ihe petleitl end the doctor 
about the effeottvenese of home oane while alleviating tha burdens on both of them in.* home-care 
environment. 

$o One solution to euah problems Is «, home oere support system that oonneote pallenle' terminals with a 
oenlral conlrol unit via means- ol communication (as disclosed In Japanese Patent Lstd-Open No. Hal 4- 
16085), This eyetem, dependant on computer-based communications, requires Its central control unit to 
Judge Intoimalton Input through the patlente' terminals (|D Inquiry, measured data, enswem to quBBilons) 
and to Iranamlt the Judged results to the terminals. It the means of communication becomes faulty or 

?? unavailable, measuring operations may not be carried out or the Judged result* may not be transmitted. 
Thts can cause serious medical problems to patterns who must take emergency meaeuremejiie or who 
need continuous testing. Furthermore, the eyatem dosa not allow the doctor to menace Individual patlente 
on the busts of time Information (i.e„ time elampB of measurements) or of the measuring Items. Because 
unneceeeery w Irrelevant measurements cannot be excluded, the eyetem ts lnoepeble ot admlnteiering 

40 home care effectively. 

DiaOLOSUFtE 0I» THK INVENTION 

It le therefore ait object of Ihe present Invention to overcome the above end other deficiencies end 
«s disadvantages of the prior art and to provide a medical measurement apparatus allowing 1h» aubjsat such 
as patients and pregnant women or their attendants to oonduot various (tlncta of medical measurement at 
heme or elsewhere outside medical Institution?. -With the subject Identified end with the Individual's 
symptoms, physics! oondlllone, constitution and environment willed, « doctor or a medical expert with 
specialized knowledge sets to the apparatus the measuring Items, the criteria tor judgment:, and comments 
eo and/or oommende corresponding fo the measured reeulle. Given the criteria and other relevant Items, the 
apparatus outputs judgments on the measured results, end Issues appropriate cornmeme end execute* 
commands In keeping with euoh Judgment*. The eubjeot oan then make effective use of euoh comments 
and the result ol commend execution tn accordance with the measured reeulle, 

in achieving the foreflolitg and other objeote of the present invention and aucerdlng to one aepeot 
sb thereat, there le provided e medical measurement apparatus comprielng a measuring unit for ouiputting 
electrics) annate In accordance with the amount of a target analyte measured (it a specimen, end a conlrol 
unit. The central unit Irtoludoe: Identification means for receiving Identlltoatlon data apenjiie to a subject and 
tor Identifying that eubjeot on the baste of the fdentllloaflon date; criterion setting means only for use by e> 
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controller who eat? comments about measured results regarding 1he measuring Item? end the criteria eel for 
ma subject end who is capable of maKln& ft speotallied judgment on the amount of the to^el analyte In the 
apeoimsn; and Judgment end dismay means for oompuHnrj tfte measurements based on ihe elaolrloal 
signals from the measuring unit and for- selectively (Uantsying the comment relevant to the otfletfa with 
e respect lo the computed measured result?, 

In a preferred siriiDture according to the Invention, the IdBtitlltoRtlnn'tfata Is set only by (ho controller. 
In qnolher preferred structure according to the Invention, trie control unit fnoludus storage means for 
storing a plurality of measurements, and the controller, retrieves the stored measurement* n desired, 
In a further preferred elruoture according to the Invention, the storage means stores the measurements 
10 with respect to v/MoJt the cHterfa ere modified as needed, 

frt en even further preferred etruottire according to the irwenlton, the centre! unit Includes either or both 
. of questioning mewtB end veriltoatlon means, the questioning mesne being used to put preliminary 
questions to the eunjeot In connection with the maaawlng Items, the ve«1lo*W0n mesne being 1 ullllsed to 
verify tliBt measurement Is performed under the measuring conditions established In accorttano* with lhe> 
re measuring Items, end only the controller Is allowed to «»t the preliminary questions end the meaou/tog 
oondlilone. 

• In a still further preferred structure according to the Invention, the oonlml unit Indurfsii time etsmn 
eeitlng meene for setting timer-counted lime stamps to be measured In keeping with the measuring Heme, 
end time stamp verilloatJon means for verifying that a given measurement we's taken et the correspondingly 
io - BBt time of day, end only the oantrolier Is allowed to set the time stamps. 

In a yet further preferred slrtiotura according to the Invention, the criterion eettlnrj means In the control 
unit is arranged to set commend* either in place ot or hi conjunction with the oommwite, end the Judgment 
end display means le elllisr replaced with or supplemented by Judgment execution mesne for selectively 
executing the commends. 

BRIEF DE80FIIPTI0N Of THE bRAWINQQ 

Pig. 1 te a conceptual view of an example of the medloal measurement apparatus practiced rb the 
preferred embodiment ol the invention; 
so flg . 2 le an «xemple of the olrcull diagram of the output section In ihe Measuring unit of ihe embodiment 
ln'Hn>ir • 

Pig. 3 1$ a. schematic exploded perspeoltve view of art example of the analysing asDllon In Ihe measuring 
unit of the embodiment In Ffg, 1: 

Hp. 4 le a oroeweotlciial view of the enatyring motion In Fly- 3 ee It Is assembled; 
ss Ftg. 6 Is a schematic view snowing an exampia ol typtoal signal commotions between' the measuring unit 
and the control unll of the ambadlmant! 

Hq. 6 le « f lowohart of an enarnple of typtoal steps carried out by the controller of the embodiment 
Pig, 7 le a flowchart of en example ol typical steps performed by the operator ol the embodiment; 
Flo, 8 (s anolhsr flowchart of an example of typical stepe curried out by the controller of the embodiment! 
«r p|p, 9 (e another flowchart of en example of typical steps conducted by the operator of the embodiment; 
Flo, 10 Is another flowchart of an example of typical steps followed by the controller of the embodiment; 
Pig, 1,1 le another flowchart of an example of typical steps carried out by tha operator of the 
embodiment; 

Fig, 12 le another flowchart of an example of typical steps conducted by the controller of the 
« embodiment; 

Flo. 13 le anolher f lowohart of an example of typloal atepa pBifarmed by the operator of the embodiment; 
Fig. 14 la a whomatlo view of an «xsmpis of the lyplcal display (on the control panel) h effeot when the 
. controller alerts making entries Into th» embodiment of Pig. 1; 
Pig, la is a oohematlo view of art example of the typloal display (on the control ptmei) In «ffeot when the 
to controller sets measurements In ihB em bottimsnt; 

Fig. ia la a settematlo view of en example of the typical display (on the control panel) In effect when the 
operator Marts making measurement using the embodiment; 

- pig. 17 1» a Bflhsmatlo view of an example of tits typtoal display (on the control panel) In effect whsn the 
cpsrator terminates measurement with ihe embodiments 
us Fig, 18 le a oorioeptuel view depleting Itow the controller operates Ihe embodiment end how the conirol 
urtll of the embodiment sole In response; and 

Pjg. 19 le a conceptual view showing how Ihe operator operates «ib embodiment end how the control 
unit of the embodiment acts in response 
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mr mode for opsmm out the invention 

Tha preferred embodiment of the- Invention will now be deeoribad wllh retefcnoB to the accompanying 
drawings. 

e Fig. 1 fa e ooftOBptual view of a medlo&l measurement apparatus p/wlloed 69 lite preferred embcdl- 
msnt of tha Invention. 

The msiJlofll ijtBaeuremont apparatus 10 in Fig. 1 le one whtoh allows not only heBiiiwwe proteselonsle 
suoh «s doctor* end nurses but also the eubjeot euott as patients, pregnant women end their attendants to 
readily perfarm medloa) measurement (testing) In medical Instltuttone or elsewhere {E>.g„ si home). As 

to illustrated, the mactlosl measurement apparatus 10 primarily oomprtee.8 a measuring unit 1S and a control 
unit 14 that reoati/ee data from the measuring 1 unit 12 so as to ouiput and display measurements. Tito 
control unit 14 Includes a control unit body 10, end Input means $uoh w a keyboard 18 and a mouse 20 
used to input varfows oonriltlon© and the subject's ID dala to the syetem. The oontrol wilt body 10 |$ 
equipped wllh a display unit S3 thai cfleptaye measured result* and various comments. 

ie Tha oorltrcl unit 14 furlhar comprises a drlva unit 2d that writes and reads data to and from a storage 
medium for preserving mSaeured results end personal information. The etorage medium may be a floppy 
disc, u hard disc, en oplloal disc, a magnelo>opl|oal d!so, an to card, an 10 memory card, en optical card or 
a magnetlo oard. The oontrol unit 14 hew a oommunloallon line 24 conneoted ae needed to a host compute* 
or a aeiver at the controller's site' in medical insulations. Tha drive unit ae may be toHrp.orai«d in, or 

» attachsd externally to {or BUKlllary), the control unH 1* 

The Input mesne of the Invention may be something other Man the keyboard 1ft 0/ mouse SO 
■ iiiuBtrated; It may be npush button arrangement, a pen Input device, a touch panel er « voloa Input unit, 
The Input means may utilize a storage medium auoh as a magnello card, an 10 card, an oplloal oard, an ic 
memory oard or a floppy diso. All toiown Input mains may be usable wllh the Invention. The display unit qz 

tt may be en LCD. a CRT unit or a voice OUlput unit* or II may be a hard dopy ouiput device euah as a 
printer. The display on the screen may include not only character? but also pictures Including animations, 

A plurality ol input means end display means may be provided In suitable combination. For.example, 
operating IrtalruoilDrie, entry prompts and/or expert*' comments may be displayed In ortareolsrs and 
picture* or may ba ouiput In vole*. $uch arrangements will make the operation of the apparatus easier and 

da subject to fewer errors. When comment* era printed out In nerd oopy, they oan ba presented for later two 
by the operator. 

The measuring unit 18 has a motion for tatting mftMUremenlB of tin subject's apeollto parts, a aeotlon 
for reoeivihpj a epeolm&n collected from the subject, or a saotioii for accommodating test paper or a sample 
holder containing the specimen. VWih measurements taken, the maaaurfng unit laouipute electrical signals 
S3 representative of the subject's measuring item or of the amount of Bib target enalyte In tha specimen. In 
Fig, 1, the measuring unit ia !a composed of an analyzing asoiron f2a auoh a» a sensor otilp and of an 
output wctton for converting the ouiput from the analysing seatton 12a into electrical afflhaTs for ouiput to 
the oontrol unit 14. 

The analysing eeotlon 1«a may be either Incorporated beforehand In the output section «b, or may be 
40 attached fl.e,. loaded) to the ouiput section 12b at the time of measurement. 

The medical measurement apparatus 1 0 of the Invention fa not limited In terms of iho way In which th» 
measuring unit 12 (analyitfng section 18a) generates (outputs) signals representing tha amount otthe target 
enalyte In the specimen, l.e„ m the way the target analyte amount te measured. Any known speolllo 
analysis methode may be milked. Preferably, the msaBurlrtg unit la'ahould make use of Immunoassay, 
4t nuolelo add assay, Ifgand-retteptor assay or Ihe like. The moat preferred method of analysis Is fmnmnoae- 
oay. 

Speolllo reaoilonB of the tarset analyte under test may be obtained end roaollon-oaussd changes may 
be detected wllh the apparatus. In such oaaea, a conductivity meter Is used If changes are o&UBed In 
conductivity by reaottoni a potenAometsr Is used If potential dlfferenoee are brovghl about by reaollon; a 

ea potentloatttt, a ooubmb meter, art ammeter or other appropriate electrical measuring device 18 used If the 
. resdttm Involved Is en eleclwoheinloat reaollont a tluorametw la used ff the reaction entails fluorescence; a 
lumTnometei' Is used If the reactlort la accompanied by luminescence; and a ootcr-dltferenoe- meter, a 
photometer or a rallaotomeler Is used II the reaction involvaB coloration, Preferably, the elatttrloal measuring, 
device ehould be employed, 

m Plfl. a |b a oiroult dlaeram of trie ouiput seoiton 12b In tha measuring unit 12 oil the embodiment, the 
ouiput peollon 12b generaflnpj efeoirfoal slonflle representing the amount of the target enalyte detected In 
ihe subject's specimen through elefllroohamtoal reaolfom A WE terminal 80 end a OE terminal 32 are 
connected respectively to a working eleolrods and a counter electrode terminal of the analyzing saotlon 
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1ftt, A D/A termtnol 84 and an A/» terminal 39 ars connected respectively to a dlgltal«anatofl (D/A) 
conversion circuit terminal ami on anatcp-dlQltel (A/fl) wnvetelon circuit terminal of lhe control unit 14, Willi 
(file embodiment, the D/A and A4> oonvsrelon circuit* are located In a multl-funolton data I'o board AT-MIO- 
l6X(ffom Nallona) tnafrumerita) houssd In ihe conlrol unll body 16. The example of fig. fi oonslltutea a 
e potenlloalat circuit. The potential output by the conlrol turfl 14 via the D/A terminal 34 Is applied between 
ihe working alaotrotta and countar «T«clrade terminals of the analysing section 12a', A ourrent flaws through 
the wotting eiaatroda terminal of ih* anstyiflnB eaoUon ife In r«»porie& to the amount 61 the target anfilyte 
In the specimen. Tho defeoted ourrant I? converted to a potential by a wrrentyotantlal conversion circuit, 
and the potential Is fwipllllad by an amplifier elroult to form eleotrfoal signals that are sBntto the control unit 
to 14 via tto Aft terminal 30. 

Tha control unit 14 computes values form itio received electrical signals,' The computed values are 
. compared with oiilerle that have bean set beforehand by the controller for the subject In question. The 
oonlrol tmlr 14 then outputs a oontroller-predatermlnsd judgment on tha measured results, or output 
comments or executes commando in keeping with Ihe Judgment, 
f* The analysing section 12a that generates electrical Signals representing the amount of the target 
enatyte In the subject'* epsotman through eJso'roflheflfiloiil reaotiort may be any one of divorce sensors 
Including an enttyme sensor, an fmmiiiiosBniHir l .a nuoleto aoW eorwor, s mforaorgsnliirr) sensor, a 
biosensor, a ojtemloal sensor, a aamtoonttuotor sensor end a -gas eantor (A,P,P. Turner, 1. Kambe and 
Wilson, Biosensor* - Pundanientale ana Apportion*. M7\ Eleoirportemlom Sensor* In immunologtoei 
m Analysis, 1«87; E.A.H. Hal), Biosensors, 1600), 

Bstow le a description of an analysing asotton adopting on elsotroohemlcal enzyme Immunoassay 
technique (mown as MEDIA (mediator ttlrluelon-conlwllad fmmunoaseey), «e disclosed In Japanese Patent 
Uld'Opart No. Hel 5^64683. Figs. 3 end 4 are schematic views of euoh m flnalyatng eeottan 18a. 

This type ol analyzing aaolloit 1fis employe urine ae specimen liquid tt> assay tlte quantity of vrlne hCO 
a (human shorfonlo gonadotropin), The result of the assay la used for dragnoBls of pregnancy. 

The analyzing saatton iSe has an awylio lower plate eg supporting: an absorber 64 to the fbim of « 
round cellulose filter paper (12 mm diameter) Impregnated with a mixture of hydrogen peroxide end urea 
and fraett'drled, Ae Illustrated, the absorber 84 has a sealing portion 04a on the upper side surface of the 
absorber 64 (Ihle side will be regarded as the face and the other side ae the bash). The sssllng portion e-fa 
bo of e round, liquid-Impermeable seal (8 mm diameter) la pasted on the central portion ol the upper side 
sur/aee of the absorber fl4. 

Above tfte absorber 84 Is a stack ol round, porous, antl-hCQ antibody-rnsolublllzed membrane 6a (13 
mm d'smsler). 

An electrode plate BO la placed on top of the aitlbodylnsolublllsed membrane 62, The electrode plat* 
■» 60 fe made of * PET llfm (1B h 44 mm). The faoa and the back of the PET film have a ring-like silver 
eteo'rode (6 mm lit outer dimeter, 9 mm In Inner diameter) and a rfoo/llfce carbon electrode (9 mm to outer 
dIemBter, a mm In Inner diameter) scresn'prlnted respectively llteracon the two electrodes bdlno axlally 
allonad, Thus the electrode plate 90 has the rlnpllke ehaped silver primed eteotrode (oounter eleolrode 74) 
on Its fane and the rlnn-llko shaped oarboti printed eleolrode (wortflno. eleotrade 74) on Its baok, A counter 
49 eleolrode terminal 78a and a working eleDtmde terminal 74a are conneotsd roepoollvely to the saunter 
eleolrode 72 and the working eleolrode 74, Conductors other then the ring-like shaped elaotrodeB (72 and 
74) and the terminals (7fta and 74a) are covered with teslsl Intt and m not exposed. The elsotrorie plate 40 
also hftt« throuflh hole 70 (3 mm diameter) that penstralBB the center of the two ofeotrodss, Tjie electrode 
plate 60 la mounted so thai the through hole 70 1» aligned axlally wllh the antlbody-lnsolub'lllEed membrane 
« The through hole 70 Is fitted with a oonnaotlna part flB made of a round, glass liber filter paper (3 mm 
diameter)-' 

On top of the eleolrode plate W 1s plnoed a round, gtace fiber filter papar W m mm diameter) twaled 
by aurtacs active egeni. The ijiter paper 68 is eafally aligned with lh» mrough hole 70. A round, liquid- 
Impermeable* sent (0 mm diameter) Is pasted as a sealing part 60a onto the center portion of the curfsoe of 
to the glass fiber fitter paper S3. 

Over the glass fiber filter paper 60 Is an eroiyme labeled antibody-Impregnated part BT4 sxlally siigoBd 
wllti the niter paper 99 bstow. The en*yrf)» labeled antibody-Impregnated part U has peroxidase enzyme 
(abated antl'hOQ antibody aotulton Impregnated In a round glass fiber filter paper (19 mm dlametet) and 
freeze-drled therein, A round, nonwovM febrlo portion (IB mm diameter) Is further placed as a filter part 62 
as onto the enayme labeled, antibody-Impregnated part 94. 

The analyzing section 13ft Is topped with an ecrylto upper plate 80 having a specimen Intel port 60a (0 
mm diameter). The specimen Inlet port 60a of the upper plate 60 to axlally ejigned with the inter part 32 
below. The analyilno section 12a Is assembled by sorawlng the vpper plate 60 to the lower plate 68. 
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For anntyele, the working oteolrode terminal 74a conducting to too working electrode 74 or we analysing 
aeotton 12a la connected to the WE terminal 30 of the output oeolton lab; tho counter elsolrade terminal 
72o oomtuoltog" to the counter eleoirode 74 Is connected to the CE terminal 92 of the output ieotlon 12b. 
Alternatively, the enstyxfiuj eeollc-n «ta end output Motion 12b may bo Integrated bo that the woiMh'g 
0 electrode terminal 74a and the counter electrode tomtnsl 72a double roapeotlwly «e lite WE tsrimtfiftl 30 
and lite os temttofil 8& 

Hio operator liwoctaoe* a urine specimen together wJlh «rt electron mediator compound such ae p' 
benwa.y]riorio Into theapeclmen Intel porteOa of the analysing section lie, Mweurament I* ete'rted by the 
operator pushing a measurement elflrt button oti the control unit 14, to be described rater. 

w With measurement started!, the. control unit 14 oaua&s the output saotion ifib to apply a potential of 
■£00 mv between the working electrode 74 (termlneJ 74s) and the counter deolrotfii 7ft (terminal 72a) of (ho 
analyzing eectlpn 12b, and measures ifio wctuotler* ouwenl through ine WOrWrtg eteotrode 74 ovary aaoond- 
Current measurements taken ov«r Ihroe to five mtouieB following the start of measiHBmem are.avere$»tf. 
Th» average ta put Into standardized folettonel funotlone Incorporated m advance Into the arithmetic 

» s processing, meohantsm In Jhe control unit 14, whereby the hOG concentration In the epeolmen ia computed. 
The oompuHtf value l» compared with the criteria, eelabllehed by the ocmroller trr the control unit 1 4, 

The liquid spearman Introduced Into the analysing sBDtlon 12a. In lite manner describee* passes through 
the litter part 62 (hat lemove* a^gregatee and other Impurities from the liquid. The specimen liquid then 
dissolve* the eweyma labeled antibody of the entyma Jahelsd entlbotty-lmpr«0nntait part 64, bypaiiaee the 

so sealing part 99a. afld flow* Into the glass fiber inter paper 80, During that time, the hOQ antigen In the 
specimen liquid la bound with the orwyme labe'sif antibody to form an enHgon'onKyme labeled anllbotty 
complex. The liquid. specimen Mar pastes through the connecting pari CD and the through heto 70 ol ihe 
aleaircds plate 60 to enter the antibody insoliJblllsod membrane* 02, bypassing the seating portion 64a 
below. The llQukl penetrate* through ihe antibody Insolublllzed membranes 82 ratiltJiy from the center to 

is the periphery, to bo absorbed Into the abtorber 04- to dissolve a auffjclent amount of eiuyrne substrate 
therein. 

.While the eponlmen liquid Ib penetrating through the antibody' Ineolirbllrced membrane 62 radially, the 
anllgen-anaymo labeled antibody complex mentioned above Is further bound wllh an Insolubllkod antibody 
to farm a sandwich typo complex (Ineolublllxad antlbodHntlgen-tebeled antibody oomplex). For Ihte to take 

eo plaoa, the antibody fneolublllwd membrane 02 have a distribution of tlie labeling entyme formed In 
*ocordsnao with ihe amount of the antigen by the aandwioh-typo blndlno to ilia labeled antibody and ihe 
ineotublllzed antibody, That Is, the greater the amount of the BriUg&h in ihe specimen liquid, the more 
localised the labeled flhuyme toward Ihe center of the round anllbody inaolubflfzed membrane 62. 
Conversely, the smaller ihe amount of ihe anilgsn in the apeotmen liquid, the* mora disported the lebslinrj 

95 ertzymo thioughout the antibody Insolubdlzsd rriemhreiie 02. 

in lha analysing «eot!on 12a ullllitlng the MSDtA method, the eleofron mediator medlateB between the 
ring-like ahaped working aleefrodo 74 oontaotlng tho oonter portion of the antibody insolublllted mambranee 
82 on the one hand, and the labeling emtyme distributed In the antibody JnsoliMlxed membrane 92 on the 
other hand. Through mediation of the electron mediator, the oxidation roduottorr roaetlon of the labeling 

40 enwme te measured ae a current. In the example above, (ritthxoqulnone (l.e., eleotron mediator) medlatoa 
raoyolloally between the reaotton of perejtdaeo (labeling enzyme) wllh the hydrogen peroxide subalrate on 
the one hand, and the «|«o1rode reaotlon of lha working etoolroUe 74 on the olher. In thle eelup, the 
retiuoiton ourmt ot the eleotttri mediator oaused by the eleolrode reaction al the woihlng electrotfe 74 te 
measured. The reduction current whose intensity depends on the mne» transfer through diffusion of the 

« elaolrort mediator Is eianllloently alfaoted by the dletatioo dlairlbullon between the labeling enzyme, 
molaoulea and (he working eleotmde 74, Thue ihe larger ihe number of labeilnfj ensiyrne rftoleoules 
looatlxoct toward the oenier of the antibody IneoTublllzed membranes 62 due to a high amount of the antigen 
in the specimen, the larger the current. Conversely, the more dispersed the labeling enzyme moleoulee 
throughout the antibody Imolubllteotl membrenoe 62 duo ta a low amount ot lha antigen In the epeolmen, 

b» the smaller the ourrent. It follows that with standards* relational funot)on» obtained by prior anatyela of 
epeolmene containing the antigen ol et&ndard oonoentratloni the conoenlratlon of the enllssrt In the 
specimen In quealion Is computed from the ourrent value In ihe form oleleclrloal elgnale. 

Desorlbed above la the example In which the moBsurlng unit 12 made of the enafyglng section 12a and 
output section ifib utlllrts olODfroohemloal reaotlon. Altarnotlvely, any other method or moane for generating 

as flloolrloal elgnale ralleotlng the amount of ihe targat analyte in the epaoimert may bo used ae the measuring 
unit fit of Ihe medloal measurement apparatus embodylna the fnvanllon. - 

The algtiele from the meaeurlrig unit 12 ((.o„ tneasuremonts obtDinad by the measuring unit 12> are eent 
iofheoonwoJunlH4. 
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As Illustrated, "the control unli.14 comprises th» control unit body 16 having lha display unit 88, the 
keybowd 18, end the mouse m ihat mny be attached as ne«(fed. Given the elgnel? from the measuring; unit 
12, the oonlraj unit 14 computes the measured results arid displays the measured results on the display 
unit SZ along with relevant oomnnents, The contra) unit 14 may alga execute commands In accordance with 
e thB acquired measurements , The oonfrol unit body 1 6 Is a praeeetlruj unit InoorpoMillnDj a microprocessor. 
The processing unit Bhwtd. preferably a computer or iru* like In view of versatility and expandability, Thle 
embodiment utlllzes-the tap-top computer Portable 486o (from Oompaq) that !a partially expanded. The 
eHove-ficsorllwa meaaurlng unit may be either Incorporated In the control unit body 10 or attached thereto 
externally. 

re the control unit 14 Is not limited to a computer. It may ba sny device whloh permits the use of a 
processing unit, a storage wilt, a display unit and on Input unit and which conned* to or incorporates a 
measuring unit. Anolher alternative |« to InteflWte (he conlfol unit and the measuring unit. 

A major appltoailon ot the Inventive medics) measurement apparatus re found In the situation ot 
remotely provided medical oaro such ae a hams-care setup, Typical contlgurellonB of the apparatus for 

iv remotely provided medical oare will now be described. 

Where the control unit 14 ol the measuring unit Itt Is made portable, the controller suoh as a doctor 
stores ilia criteria, fcr Judgment and the coirtmente or commands about the. acquired measured results wllh 
raepeot to Ida criteria into the storage mesne «f the. control unit 14, and hands the control unit 14 over to 
me operator, The"etor«QO mesne In the oontioi unit u tiny pa any one of a baoked-up RAM, a hard disc, e 

so magnBto^iptloat disc, a (loppy dfofc an IO card, an 10 memory oard, an optloal oard and a magMto card. 
The operator oardes the oontwl unit 14 home or somewhere outside for measurement, takes measurements 
on the spot, anal acts on the results urjltig the criteria end eommente or oommande established by the 
controller. When paying a vtalt to the controller, the, operator carries with him the control unit 14. The 
oontroller then retrieves Ihe measurements from the storage means for mtwenca Gush elored measure- 

st merits may be used not cnly a» Information by which the operator or the subject has a better understanding 
of his pathologic condlllon, but also ae information according to which the controller diagnoses the subject. 
Depending, on the circumstances or condition of the sgbjeot, the controller may modify the cilttrla or the 
comments or Commands regarding the fflBaauremante with nespsol to the criteria, stow the modifications tn 
(he etorase means of the control unit 14, and hand the central unit 14 back to the operator. 

90 ma where the control unit 14 is cot arranged to be portable, the controller such as a tiaotor may 
modify the criteria cr the comments cr commands Wflsrdlna the measurements with reapsot to the criteria, 
store the modlllcatlone Into porfabla slorerje means of the control unit 14 via the host computer or server, 
end hand the storage means back to the operator. The portable, storage means may be any ohb of en IC 
oardj an IO memory card, en optical card, a magnetic oard, a floppy dlao, a fierd diss oard, an opiloel dleo 

is and a magnato-optloal disc (MO), For measurement, the operator connects the storage means to ihe control 
unit 14 loouled at home or somewhere outside, takes measurements on the spot, and acts on the results 
wherever he Is by use of the criteria and comments or commands eetabilehsd by the controller. The 
measured results m stored Into the storage mesne, When paying a visit to Ihe controller, the operator 
carries with him the storage means, The controller then retrieves the measurements from the storage 

to means for reference using the oontrol unit body as the hast computer. Depending ort the circumstances or 
condition of fee subject, the controller may modify the criteria or the comments or commands regarding the 
measured results with respect to (he oilterla, store the modifications Into the atorege means, and hand the 
storage means back to the operator. 
• fn the above contiawatione of the apparatus', line-tuned diagnostic seHlne* are available for individual 

« subjeots. In that esse, both the controller and the subject fael re&nsuract that the subject Is being properly 
oared tor under the controller'* supervision. It Is then possible for (he measured results to be Indeed quickly 
according to the controller-established criteria so that relevant comments or commends prompt the operator 
sir the subject to take appropriate aollon or to suppress imnecwssery behavior. Ae a result, the burdens on 
. ihe com roller, the operator end the subject are 'all alleviated. 

«q Another epplloallon of this apparatus le ,a ecntlgurallon comprising comm unloatlon lines or network*. In . 
this case, the control unit 14 is composed of a control unit body acting as the host computer or server, and 
of one or a plurality of terminal* cr clients eaoh Including a measuring unit i& Ttile system configuration 
connects (he host computer cr server on the oontroirer'e side with the subject's terminal or ollent using a 
eomrauntoaltoH line 24 cr the like, the controller may thsn take note of the subject's pathologic condition In 

as real time, Issue appropriate Initructlone andfor take relevant action accordingly. 

tn a relatively restricted eree suoh ae Inside the hospital a LAN celup Illustratively based on the 
Hhernet may bo used fox cammwiloallon purposes. Whore remote locallone are Involved, a leased line 
network or a public network may be employed. ThB oommunloallon line may be etlher a phyaloal line such 
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a» a tataphone Una or wireless olrtulte euoh as those utllJilw a conrmnuniCRtlon satellite. 

Pig. B Ib 9 tohemallo vlew-showlng i/ptoal eigne] oonneollons bstwaan ihe measuring unit 1S, lh» 
control unit 1 4 audi a host computer or server 100. The storage means of Ihe control unit 14- or (hat of both 
■ (hs control unit 14 and the hint computer or server 100 aoaomrnodaies & group of control commande for 

« controlling the measuring unit 12 during measurement, ihe' orlterla for Judgment e&teblfflhetl by the 
controller, and comments and commend* about the measured results with respeot to the criteria. The 
(torage means rn«y b» any on> ot a ROM. a baoketfoip ram, b oard medium joe end 102 such as an JO 
card, an to memory card, an optical oard end a magnetic cardj and « storage medium 18b and 104 such as 
a hard.dlso, « magneto-optical dim. a, floppy disc, a mapnelto taps and a DAT, In Pig. 9, reference numeral 

to 109 Indicates Input moans such a mouse and a keyboard of the host computer or server 100, end reference 
numeral mats a display unH otlha host computer or sewer 100. 

Below 1b an example In which tha controller establishes various diagnostic; settings using the host 
computer or server 100, wftfi n remotely (emitted operator using the control unit 14 for measurement end 
medtoal oar* via ttte communication line 84, 

is For till* example, It Is assumed that at least the control unit 14 stereo a group of control commands for 
controlling the control untt 14. 

When the operator emits the control unit 14, a group of control commando Is retrieved from (he storage 
means of the control unit 14 to oontrot the control unit 14. With measurement oomplstecj, the measured 
results are written fo the storage means of the oonfrallsi'e, host computer or BBrvsr 100 and/or to the 

so storage means of the control unit 14, WhBto nensasary, the controller' may retrieve far reference the 
measurements from the storage moane of ihb host computer or server 1b». On the bsBle of tha measured 
results, the controller may operate the host computer or server lot) to modify as needed the wlterie for 
Judgment as well w the comments and/or commands about the measuremente with respect to tha ©uterla. 
The above scheme allows (he oontrot unit 14 t» mate measurement even it the oommunteatlon line 

as beopme* faulty. Thus the «oham& te safe end preferable. 

'The measured reBultemay be elored In one or both of the two storage means; one for the control unit 
14 on the operator's aide, (he other tor the host computer or server 100 on the OMtroilsre aide. The 
measured results may Include computed values regarding tits target analyt* In the epeetmsn, the operator'* 
name, the operator code, the subject'* name, the subject code, dates ot measurements, time stamps of 

oo meaBurenieflte, end the operators answers to preliminary ojueatlona. Where storage addresses end storing 
methods are etandajdlwd, the subject or operator may receive individual supnrvlelon connurrehtly from » 
plurality of controllers. If the measured results, are written to the storage mesne of the control unit 14, the 
eubjeot or the operator can readily reference tits past measurements therefrom. This Is preferable In terms 
of belter eelf-aare. In particular, tha storage means 1b preferably detachable, euoh m the card medium 10* 

$b (e.a„ Id oard), nappy disc or the like, Such storage means will allow the aublsot or the operator to utllla» 
advantageously a plurality of aontrol unite 14 (at home, In the oflloe, eto,). Because the subject or the 
operator can readily handle the portable oard or like medium on hts own, ihe *ub]ent or the operator finds it 
easy to manage hie own medical data. This aspect ot Individual data management ts desirable In view of 
protection of privacy, Furthermore, the easy handling of the storage medium makes (t easier for a plurality 

4o of «ub]Bois end operators to share a single control unit 14, 

On the other hand, If the measured results are written to the storage means elfacfwd to the host 
computer or «erv»r 100, the oortlrollar euoh as a doetor may build the pathofogkt conditions of a plurality of 
subject* [».$„ patlente) Nhtatmttvely Into a database for coHeottva supervision, whtoh ts desirable for better 
health cam from the ocfflfolter'e viewpoint, For this to be Implemented, the measurements may be written 

4t bolh to the storage msans o) tha control unit 14 and to the storage maane of the host computer 100. For 
efficient wmrminloetton, the measured results may preferably, be transferred In batoh'.form to the host 
computer' or server when data transfer Is requested by the controller, when the measured results have 
reached a threshold level {to trigger & command), or when ihe storage means of the control unit has 
become Ml Under certain circumstances, it is also preferable to trigger data transfer depending on the 

so answer to a preliminary question. Any- or alt of the above alternatives may be selected in consideration of 
tfie pathokujlo conditions of the subject to be supervised, the life styles ot the controller end of the subject, 
and the costs Involved (communlo&lion oo$te In particular), If the comfnunioattwi means develops failure 
rendering In* comm&MOfltlort unavailable, the eSHInge and the measurements ma etlll held In the storage 
means of the cojilral unit 14. in that oass, them is no problem with measurement end Judgment ojt the part 

ee cf Ihe control unit 14, 

- The abovfi<manlloneti connection baaed on iho oommuntoaltan line can afford additional bsnstlte to the 
medical measurement apparatus of the hwarillon, Foe example, In a homs-oare situation, it la important to 
respsotthe patient's rfght to know, (it particular, a «eIf'mananTng patient should preferably be encouraged to 
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take part actively in the parformBnce of mBdioHl am «t> as to gain better fherarwutlo resulte. Wllh ihls 
apparatus, loo, It Is titrable nor Information about the controltsr-sel measuring Heme and criteria to be 
made available (o the subjaot or operator upon requael, illustratively, the control unlt'lh the operate)'* 
possession may be connected via a oommuntoBtlon line to isucrt data sources bb on externally fumlshftd 

o database and a database housed In the host computer or server on the part of the controller. Buoh m setup 
allows the subjeot or operator to retrieve Information shout the relevant examination or medical oars from 
the* aofflrol unit, The relrtevatole Information may Include. the content of the examtoallon<|.e„ purpose of the 
examination), the examination mslhwJ (the manner to whtoti the examination le to be performed), end 
criteria for judgment (normal vatuee). tofnrmalton may tie retrlaved from th» data sources by use of 

10 aommahda set by the controller. Whereas It ; Ib feasible to Incorporate In the control unit a data. source In the 
form of, eay, OP-ROMa, a wider range- of applications Is available when the eubjestor operator f» allowed to 
have efawBa via a communjoeiton line or network to an external data source. 

It should be noted that as mentioned above* the measurement, ludftmiuit end other function* of the 
control unit 14 do riot presuppose the presence of the communication line £4. 

1? The control unit 14 (control unit body 10) of the above oonaHtuHon comprise*: identification mesne tor 
Identifying lh» subject of measurement; criterion setting means only for use by the oontroller auoh 49 a 
aootor who. la capable of making a sp'enlalteetl Judgment on the amount of the target unialyte In epeotmsna 
by use of epeolatized .knowledge about the measured results; and judgment and display means for 
ocraputlitfl msflsureinmna basBd tut the output signals from the measuring twit t« and for selectively 

to displaying relevant oommente about the oamputed mefisurftrnBiyia. Preferably, the medical measurement 
apparatus 19 tee otorage means for storing a plurality of measurements, questioning moans for putting 
preliminary questions to the subjeot (operator), and verification mesne for verifying 1hat meaeuramsrit la 
pertormsd under appropriate oontflitona. ' 

ins identification means re a function that idcnuilee the subjeot of measurement based on hie 

m Idenllfloatlon data supplied by the operator. 

Equipped with thle Identification means, when the medloel measurement apparuUje « of the Invention 

• allows only the identified w&Jeot, no other subjects ere examined end the apparatus le arranged to 
aooumulsto measurements of ontylhe Identified subject^), ' 

When the medioal measurement apparatus 10 deale wllh a plurality of subject*, the apparatus le 

so constituted to texe measurements epeoiltb to eaoh of the individual wbjeote. It unneaeesary measurement* 
are tpksn of any subleot, they aannot be examined by tha apparatus and only the relevant measurements 
are accumulated with reepemo the Individual eubjasie. 

Thus the Inventive medloel measurement apparatus 10 doae not mix measurement* of one subject with 
those of any other subjeot. With the possibility of mlxed-up measurements eliminated, the onniroiler euoh as 

ijs tne doctor ift not misled to make erroneous diagnosis based on the toaoireoiiy aoatrmulatod measurements. 
The medioal measurement apparatus to of the .Invention poses no spacfflo oonetratnta on the typss of 
utrnbh tdonlllloaltort data about the subject. Tha ItfenllNoallon data may preferably Include personal data 
euott w «i» name and the date of btrihythe to code euoh as a pmtwwt number, the Ungerprhit and the 
volo* print of eaoh subject; the Idenfllloatlon m»y be provided alternatively In the physical form of a 

« security card or a t»y possessed by the subject or by the operator. No specific oonetralnts exist on the 
manner of enterl ng the fdentliloation date, That Is, the It) data may bs Input by use or the Keyboard 18, tha 
mouse id, « touoh pane?, a bar code raaderj « card reader for reading 10 cerde, a magnetic cards or optical 
osrds; or a dlso drive for driving floppy dlsosi mssnato-cplloal dlsos or hard dlsoB. 

In other wards, the embodiment af the Invention may utilize advantageously any of the diverse means 

«r of personal IdsnllHoaHon. Howaver, It la preferred that Ihe apparatus should be made unavailable tor 
measurement tiniese and until both an ID card (eg,, security cm) and a password code are entered. The 
health Insurance card, driver's Hounsa, electronic mad leal Dhart or olher personal IdentlflcatlDn card of the 
subject may use «e his ID card or security osrd, Alternatively, the ID oard may be a card Issued by the 
oontroller at the time of registering the patient with the apparatue. 

so For-lho medioal measurement apparatus 10 of the Invention, the IcTenllfloailon data should preferably be 
set by the oontroller done, To have the settings of. the apparatus established only by the controller requires 
two things: either the controller alone la allowed to make or modify the eehlnss, or only Ihe subject or 
operator authoflied by ihe oontroller le to carry out the eame. 

These airangBments are Intended to prevent the operator or any other third party from Inadvertently 

«s altering the Identlllo atton data or from making oiher eareteet or deliberate mooloailone of data. 

Them are no epsoKto constraints on the manner in which to set htentlllcatlon data. Tha same methods 
as those ailed Above -for entering thB ID data may be utilized. . 
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eimllet!/. there exist no specific t'lmlia to the way In whtoh to tlmll the quantitation for setting ID data 
oi)l/ to the controller. Any aim at various known methods for entering the subject'* Idenllf loallon (tela suofi 
as tho use of tho controller's ID code may be titllteod. 

Tho criterion vetting moans la used only by ttto controller euon e.9 a doctor who has epaolaiiwtt 

c" hnowlftttge on medicine end who set* tho Heme of rneaBuremsnt, t|te cvlterln for judging measured reeulte, 
and comments and commands about tho measurement* with respect to tho criteria, Tho eettlnge con ba 
made for oaoli Individual sub|sot and in consideration of tho ohangee over lime In tho subject'* conditions. 

To make effeollve use of the measurements taken by too madloal measurement apparatus rerjulree 
aelaollng appropriate measuring Hems by tattlrtg Into aoaount tho pattenUs pathotagtp conditions and 

to symptoms, the reeutt of tho pregnanoy test performed on a woman, a molftw'e phyeloal conditions, arid 
Other retewrrt efotoe of the subject fn question. 

Tho (n9«$urei¥tonl« (measured results) taken In mectloBl examination vary depending on n number of 
faotpre. These faotor* Include the patient'* palhclogto conditions, physloal dlrfe/enoee among a plurality of 
subleolo, tho number of weak* of. pregnane/ for a pregnant woman, end other todMdual ofrcumslatwe* of 

>6 th»eubJwiin<|UMiiftn. 

fh» conventional medical met* wement apparatuses have their measuring Heme established In'advanco 
end do not allow' the- Items to bo modified according to frtelMdUfli euhjooie. With ell rneaauromente 
displayed numerically by thoae apparatuses my operator with no specialized knowledge And* it dlfiloult to 
make e proper Judgment on the measured results, 

w> fn the oonvenltoriBl medtoal measurement esperetueoa. even whew criteria for Judgment (I.e., cut-off 
values) m established, the orltwie, ere fixed Tor ell potential end aotuei patlenie. The comment* about 
meuBureuients with wapect to the criteria are limited mostly to auoh simple etatement* a* "high" end 
"low. 11 In auoh a conventional setup, the subjaot Is unebleto grasp hfa conditions property. 

In oonlrast, the medical meaiuremem apparatus 10 of the Invention allows suitable Heme ot measure- 

u merit to be Befooled for Individual subjects by the controller. Illustratively, the raeaaurlnpj Heme era selected 
by purpose: for determining pregnancy, grasping the mother's phyeloal oondlttone, end finding the patient's 
patholggto oondlttone. Appropriate criteria for Judging the measured results are also set up, and a variety of 
comments about the measured result* with rienoot to the criteria are provided fey the controller such a» 
doctor. Buoh comments provided by ths controller may Include: "You are In good health/' "Oonltiot Our 

bo hospital «s f oop w posBlbfo," u 8ae your dootor at our hospital ae aoon as poaslble, 1 ' "Take tho drug," 
"Stop taking the drug," and "Take measuremente {of another meaauilnrj Item}." (( Is also possible to set en 
appointment for the next measurement or examtnalton, 

With the Inventive medical measurement apparelue io, euoti measuring lteme t criteria for Judgment and 
comments may b» set or modllfed bb needed only by the controller auoh os a dootor with specialised 

as knowledge. 

Commands may be executed in piece of or in addition to the comments displayed. Although the display 
ol commenle may be regarded «e » kind of commande, separate commands should preferably be furnished 
Illustratively ae follower 

(1) A command mey cause the ttpparatue to take mewurements of another Item X hlthwfo>unRu.llwriwd. 
49 triggering display of a comment "Measure X next" to prompt Iho operator to proceed with the 
m»««urement. 

(3t) Another oommanel may dbubb the apparatus to transmit an olarni to tho hoot computer of the 
oonlrollBf, to oommunloele with the oonlfolto'e hoet oomputer vie & tommunloetlon llne^ or to place a 
totephone ohII to the controller. 
as (3) On the basis of tho measurements taken pf tho titer target anslyto, anotltar command may oauee the 
apparatue to mod Ify the of ttarla for Judging tho ooeond target enel/to to be examined. 
(4) Another command may otuue tho apparatus to alter the constraints on the dates on whloh 
meaeuftmenl Is euthorlrad. 

(B) Another oommatict may catjBO the apparatus to transfer the measured results to the host computer or 
eg server on the part of 1h» controller, . 

{6) Another command may cause the apparatus to coll via a oommuntoetlon line an examination 
appointment etetu* eoreerj as well as euoh teniae program* as en examination appointment entry 
program from the controller's host computer or server, 

(?) Another command may cause the apparatus to retrieve Information from relevant data sources (e.g., 
eg databwe). 

Execution ot the above command* la desired tn eHuettons where the controller and the subject ere 
oeperetod over a long distance or where the measurement and the oara involved ere highly urgent. Whew 
the eubjeoi or operator Is not oxpe'Dled lo seek relevant medical oare promptly due to Impediments such ae 
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"edvanoed age, the controller should preferably sat m ^vanoo naoessary measures, as commands to ensure 
appropriate medlcpl oare, 

Acceding la ihe medical measurement apparatus of the Invenltan, Individual subjsots are allowed to 
take measurement betl ,111 tor themselves Inside or outside msdloeJ Inslllullons, to noelvo experts' 
« Judgments on tbslr moMuremente in an individually ou»toirif«d manner, and to into twessary aoiion as 
prompted euoh ae visile to tha ctootor or changes In the frequency of measurement. Measurement and 
medloa'l ireajment Bwlhus made available effeatlvaly and eflfolentfy to those, who neat) thorn. Trie medical 
measurement appamliie. -allows the eubjeoie lo Hue wIlN a sense of eatwrlty at homo or *I«»wher* by taking 
measHmmama on ihalr own and verifying the experts' Judamonte on their measijrenumte. Ths measured 
io result* provide- a very effectlv* aid to thosa engaged In taking ear* of 1he subjects, in short, the Inventive 
medical measurement apparatus offers remotely provided, aflloaolout me*dloet osro to homa-eare situations. 

Furthermore, the medical mBasuremsnt sppsratut of tlw Invention is far superior to aonventionBl 
system* or apparatuses In providing detailed and proofed oonlrol over madia*] measurement by the 
conlrolltt euoh «t» a doctor and a pharmacist with specialised knowfedgo about mBtttoaJ care, The controller 
it can make sure that ihe apparatus Is appropriately utilized end that Incorreoily acquired msaturoment* do 
not result m.mltdfagniiete, It la also possible to Inhibit (h» measurement of Items not eulhorked to a spBollIo 
. subject and to prevent the abuse of Individually acquired measurement Information. 

f here are no speoillo constraints on the manner In whtoh to set (he Items of measurement, the criteria 
tor judgment, or comments. The «me melhads a$ those otted above In oonnsolton wlih the entry of 
so Idenllllofllton data may also bs employed. It Is not necessary to match one iriBasurtna (tern with a single 
criterion and a single comment] eaoh measuring Item may aorresponci to a plurality of oilterla aa well as to 
a plurality of ccmmanta and oommande. This makes It possible to provide more preolee. i ine-tunad medloal 
measurement tailored to eaoh eubjaot. 

Ukowlao, no speolfio oonslralnte exlal on Ilia way In which the controller alone la allowed to Bet the 
as criterion setting means. A« In iha case of tha aubjeot'e Iderttllloatlon data and of the manner of entering 
«uoh ID datej various known methods may be used* moUidlng the use of the oontrolter'e identHieatlon coda 
to make entries Into n pmdetemilned subroutine dedicated to the controller. ■ 

Below Is an example; of how the controller alone ia permitted to set the criterion setting means. 
When a subjeot (e.g„ patient) vlslto the modloa.1 institution to see the controller such m ft dootor for 
. 99 medtoai examination* the oontroiisr atow into a "healih oare card" the Items oi measurement «pproprl*to 
to, the subject's pathotoflln oondlltons, the criteria for judging measurements, comment* and oommanos> 
These settings <jr$ stored by the controller using a wader-wrlter or a dlso drliro connected to the host 
computer, into thtoefd In the form of a storage medium euoh as an 10 card or « floppy dlao. At the same 
time, the eyjjjael'a name and oilier towlo personal date on the subject aw stored Into the oard alonn; wllh a 
as password code ohoBen by the subject. Entry of the data Into the storage medium by the oontroiisr requires 
the use of the eeourlly oard possessed only by the controlled fits password code known only to* ihe 
controller, or both. 

The controller hands the health oare card thus prepared over to the relevant subject, together with the 
security oard dedicated to that aubjsot as naBdsd, The subject takes hie healih oar* oard home and 
40 connects It to the control unit 14 of the msdloat measurement apparatus 10 In hie possession, upon 
measurement, the measured results m written to the healih oare oard, To carry out the measuring 
. operations requires the use of the security oard possessed only by the subject the password coda known . 
only to the subjsol, or bolh. 

The control unit 14 oheoke to «e» If ihe Intended measurement Is appropriate in view Of thfr date and 
<p time ot the measurement and of the answers to preliminary questions, put to the subject. Than In 
aceordanoa with the criteria set by the controller, the oontrol unit 14 judges the measurement? and displays 
. and/or executes rolovatit oommBMs and/or commands set by the controller, if the subisal la unable to 
perform measurement on his own. en operator may take over the measuring operations from that subject, 
At the lime of measurement, Instead of the subject seleotively enterins the rneae wins Items authorized 
60 by the oonlroller, the connected measuring unit 12 (analysing eeotlon 12a) may alternatively discrlmlnale 
and establish the appropriate measuring Heme automatloally. Tha dleorlmlnatton mesne may be any one ot 
known means employing output signals, bar oodea and a rnagnetta tape used for connecting, the appsralue 
components, for ehepe fecoanltlon by the analysing eeollon 1 2a, end for oonneotlon with the monsurlno unit 

12, 

tt The judgntsnt and display msahe computes measurements from eleoirloal signals from the measuring 
will 16. Comparing Ihe measurements' with Ihe orilerla, Ihe Judgment and display means eeleots the 
appropriate oommeiit and displays It on the display unit ao. 



ta 



The Judgment execution means computes mwMHinmiimt from olaslilcal signals from the measuring 
unit 12, Compering the measurements with the orltewa, the ludgment execution means, selects the relevant 
command and causes Ihe centra! unit 14 to execute that command, 

The Illustrated medical m&ajgrsmeni apparatus 10 ot ihe fnvsntton preferably comprises storage means ' 
« for staling and accumulating a plurality of measurements tor each subjeot, Tho storage moans la preferably 
aonalllutod so that Iti* aonlfoirer reirteves the stored date, as duslred. 

Willi the oonBilwtton above, the wnlroller such ea a doctor may reference tfie accumulated measure- 
ments for subsequent treatment or measurement Because the medical measurement apparatus 10 of the 
Invention uaes lie Identllloallon means to Identify tha eubjeol for meaauramsnj, ihe resulting measurements 
to will not be mixed up with measurement* of any other subjeot, This allow* 1h* controller to paea en aoourale 
Judgment on the relevant measurements of the «ub)sm in question. 

For the rtsdlonl measurement apparatus 1ft of the Invention, the measurements or measured results 
Inoludt. not only medically measured data but also the dates antt lime stomps of measurement, the 
measuring environment, measuring con dlllona, the subject's pathologic conditions, the subject's answers to 
» preliminary questions put to him, the subjsora reactions to the measuring oondltlona In effect, ambient 
information such as temperatures pbtalned by temperature sensors, and other Information associated with 
Ihe measurement, 

The Illustrated medical measurement apparatus 10 further Includes qupeilonlng means for putting 
preliminary qusslloiw to the subject to oonneotion with the target Item to be measured, and verlHcatlon 
so means for verifying that measurement is performed under the measuring oDndtttone established to 
acoordsno* with the measuring Item In effect. The questioning means and the verification meant ar* 
oortniiiuiBd so that only the controller la authorised to est the preliminary questions ea wall a* the 
measuring conditions. 

The medical measurements thus taken often vary Spending on the subject's oondfttene. 
an For example, mnafiurementa of urine hCG Men from Iropttoblasllo dlneaeii vary significantly depending 
on the number of daye that have elapsed sfno» the aubleot underwent the operation, for pregnancy 
diagnose, measurements of urine hOO) also vary considerably depending on the number of days that have 
elapsed slnoe the subject'* previous menstruation parted storied, 

Meaeuremanta of blood hPL and' urine aatrlol fatten In order to grasp ihe p»flnant women's condition 
o\> vary quitfl appreolably depending on 1h» number of weeks of her pregnanoy. 

Furthermore, measurements ol aldosterone and plasma renin activity vary significantly depending on 
whether or not the subject Is on an empty stomach at the time of measurement 

Meanwhile, to lata meeeuremente of stool hemoglobin requires acquiring the measuramsnte and 
referring thereto every day. 

as To judge accurately those measurements thus requires altering or selecting ihe criteria for judgment 
tt.e„ cul-off values) In ecaofttanoe with the subject's condition. 

The medlosl measurement apparatus 10 of the Invention preferably puts prelim Insry questions to the 
subject with respect to ths measuring Items. The apparatus Is conslltutad preferably so that, depending on 
the answers to the questions, the apparatus eetsois th» criteria, for Judgment, comments and/or commands 

*» te.be used, 

Per some measuring Heme, no measurement* will be referenced and regarded as viable ll the 
measuring conttlllons euoh as the measuring lime, measuring period and temperatures are not elrlolly 
observed, 

Per example, measurements of aldosterone end plasma renin aottvliy am not considered rellablelf not 
-» taken early In the morning, Where Inslfudtlona are to b» given to the subject far fading drugs, It should be 
noted that measurements of the current drug concentration In blood are dependent of Ihe Me atwhioh the 
subjeot previously toott the drug, Wften the medication time Is entered Into the system fn response to a 
preliminary question, the doctor can subsequently give appropriate Instructions to the subjeot. 

Ttoig the medlosl measurement apparatus 10 preferably Include* the verification means for verifying 
sir that measurement la performed under 'predetermined conditions, If art attempt- la made to conduct 
measurement under conditions other than those determined beforehand, the system will not let measure* 
ment be carried cut or will give en alarm, if nsoeeBary* the eyatem is constituted to give an alarm at a 
pnjBurtbsd measuring time so fie to prompt the subjeot to tefce measurements. 

Preferably, only the controller Is etilhorlnid to set the above-mentioned preliminary questions end 
so measuring conditions. 

The arrangements obove permit ihe medical measurement apparatus to provide Individual subjects with 
more llns-tunsd and customized medical measurement. 
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There ore no epeolflo oonBlralnta on ttio manner In which to sat preliminary questions or meaeuJlng 
conditions, The asms methods as those oited above in oonneotlon with the entry of MentlHoation data my 
b&ulned, 

eiinllsily, there m no apeolllc limits to Ifte my to wtiloh only the controller is eulhorfrad to eat tho 
a preliminary questions and measuring condlttone. 

Various known methods olted In eonneottor* wt(h the eubjuot'e identHloatlon data and with the entry of 
fiuoh 10 dele, Including fit* uee of tho controller's tdenlllloallDn on do, may bo employee). 

Where the preliminary question? ere related to the passage or trme apeottlo to thB eubjeot dumber of 
woefte of pregnancy, ego, etc), ihe data constituting ihe flueeitona may bo Input and etored In advance In 
io tho control unit body 10, fit operation, whan tho Idorrllfloatton means Identifies the subject, the system may 
automalloelly select the orllerla for Judgment or Other relevant settings In keeping with ihe time-related 
conditions, 

The preliminary questions may bo cornwfied wlltt other measurements such as blood or urine come/it 
-. measurements (urine auger love), blood auger level, eto,), blood pressure, end body temperature. With 
is roaponaaa given to ouon preliminary Question*, tho controller oen evaluate the criteria and Judgments In 
more detail regarding Individual subjeote, furthermore, the above setup makes It possible to furnish tho 
operator (any one of nuttee, clinical technicians, other dootore, eto,) vyllh mora preolee, Individual 1/ 
cuetomfeed fnewuctione that will lead *o batter weatment of each eubjeot, 

The Inventive etruoturw above etso moke II possible to avoid tatting unnecessary measurements 
so regarding Ihe previously selected measuring Items. This allows both the operator and the aubjsnt to bear 
lass burden in medical <w* than before, and tho resulting cost savings are oonaldBmbla. 

Whore preliminary questions are put to Ihe subject wllh respeot to oilier mafwemenie «uoh as blood 
or ttrlns components blood pressure end body temperature, these measuring Items may also be sot In the 
medical measurement apparatus or this Invention, Tho measuring unit for taking meaeuremeftte regarding 
n the preliminary queetlone may be ellher oormenred 10 or Incorporated in ihe Inventive medJoat measurement 
apparatus. In auah cases, the medloal measurement apparatus may be arranged to read automatically the 
' measured result* furnished to tho manner dasejlbed, 

For example, Cwaetlve protein (OftP), representative of aoute phase protein, measures high under 
suoh pathologic oondltloriB as Inflammatory dleordere (Inreolioue disease, appendicitis, pneumonia, hepatitis, 
so eto,), InjurtOB, the poat-eurgtofil siege, pregnancy and collagen disease. 

For this reason, the measurement of ORP la not only an item used extensively for pathologic screening 
but also en Kent tor whloh suitable criteria need to bs set for Individual subject?, 

The Inflammatory redollon of (nfeotloue diseases generally Involves increases in body temperature, This 
means that trm measurement of GAP is not mandator/ where the body temperature remains below a certain 
ss level. 

llluetrallvety, when the wbject'e temperature, given In responeo 1o a preliminary question oi waived 
from a temperature eeneur, tome out to be tower than a level (e,g„ 57.0 >C) apcollla to the subject, the 
oyetwn may be arranged to teeue a comment eeylng that the measurement of CRP te unneaeeewy. 

$ueh tin anrangement allows the measurement of ORP to be skipped where appropriate even If that 
40 measurement has been established ae a measuring Item, Tfila translates Into leas burden on both the 
operator and the aubjaot and (more (twinge fn emnomlo terms, 

The criteria for ludgtng CRP meaeuremonta era set suitably for Individual subjects, Generally the 
threshold value for Judgment Is about eoo wg/dl, for eubjeote 8 to 19 years old, and about ?Q0 wg/»l- for 
adult eubjeole, The threshold value should be higher -for pregnant women and patients In the post-eurgloel 
<js triage, 

When the measurement* turn out to be below'lhe threshold value tor judgment, the apparatus Isaues a 
comment eeylng that although there Is nothing unusual at present, the subject ehculd pay attonHort to 
evbsequent ohangea In body temperature. If the tnoaeuremente are found to be higher lhan the threshold 
value, the apparatus leeuee * comment prompting the subject to contain the doctor at «noo or oxeoutes a 
so command calling up the doctor In charge by radio pager or the like, 

Shown below are tables listing lyploal preliminary questions, cut-off values, comments and other related 
data whtott may be furnished In conneolfon vrilh measuring Heme, 

The listing* are only for Illustration, end they may be altered as needed by the controller In aooortlenoe 
•with the subfeef e pathologic condition* and wllh phyeloal differences among Individual aubjeote. 1 
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poWod wee 3X) * i.0 ngiml, m coniroller may oiler the oui-off value to A r^/ml, Thfc enaurw mow ©onurate 
measurement. 

In (he example of Table 1 abova, the wins LH concentration t$ dlowotl to be measured between 4:00 
and eiflO am., and the orHerfa lorjudgiment (out-off values) c«nt«r on 80 miUM 

e tt may happen lhaMhe mine IH concentration measurement over the put three .month* have IncHoated - 
that the urlna> LM conoentrtrtltnt during ovulation of a particular subjoin who wants to bacome pregnant Ib 
loww than (hat Of the average woman (fiO mlVAril er'hlflher). With the default sottlnos in effect, It Is difficult 
for tfie subject In question to ' find mo peak urtoe LH oonoenlralton durtofl ovulattoii. In that cast*, the 
measurable time may bo <tet alternatively for W to fiioo as well a* for 16:00 to 80:00, the cut-off values 

10 may bo supplemented with o valu* of 10 mlU/rnl, and the ocmnient* may be modified as shown below. 
Tlteso nryactmcattone allow tho subject to find rnor* precisely tn» poak urine LH concentration during 
ovulation. • 

. Preliminary Gueetlone 

«r 

1 ■ It this your first measurement? - 

a. Is this your eeacntl or subsequent measurement? 

Cut-off Values end Comments 

so 

. If your answer to preliminary question 1 1s "YES": 

(Cut-off vetoes): Lower than 10 mtU/ml 

(Comment}: Tate measuramsnt* *8a!n 12 hours later, 
as (Cut-otf values): 1 0 mllMml or hfflher, lower than £0 mluVrnl 

(Comment)! Ovulation la appealed within 48 hours. Tate measurements again 12 hours later, 

(Gutsrif values): Ob mlU/ml or Mghsr 

{Comrneni}; Ovulation fa oxpaetod within 24 hours, 
If your answer to prolimtiwy question a la u YE8"t 
so (Cut-oft values): 20 mlU/ml or higher 

(Oommant): Ovulation Is expo eted within 24 horn 

(Cut-off valuta): Lower than 1 0 mtWrnl both lasl time and this time 
■ (Oomment): Tate measurements again 1£ hours later. 

(Cut-off values): Lower than 10 mlU/ml lasHlme, lOmlWm! or higher and lowentian 20 mlV/ml mistime 
as (Comment): Ovulation la expected within 48 hours. 

(Cut-off values); 1 0 mlU/ml or hlgfiDi' last time, equal to or tower then previous measurement thle time 

(Oommant): ovulation is expected wllhltt S4 houre, 

(Out-off values): 10 miu/mi or higher last time, eqwsi to or higher than previous measurement end lower 

than 20 mlWirH thle lime 
to (Comment): Ovulation la expected within 99 hours, 

Regarding ttio urine hCG measuwmente for patients wlfh trophoblastic disease shown In Table 1 above, 

the offlerfa (or Judgment and the comment* are set In acoordanoo wllfi the number of weeks that elapsed 
' ulnoe the day the eubjeot was opsrated on. It rosy happen that when the patient with trtphoblaoife tilseaee 

Is apparenily In retmMton, urine hOG maasuramsnle era desired to be taftari to make sure Ihat the paflttrt 
4s has not relapsed, in that vase, the preliminary qusstlons, measurable time, cut-olf vaIubb end comments Irt 

Table 1 may bo modified as followe: 

Measurable Time 
4lo0 to 8:00 nm, 



Preliminary Questions 

1. is this your flret measurement? 
as , Ms iht* your second or sifosequent measurement? 
Cu>oft Values and Commenta 

It your answer to preliminary queetlon 1 1s "VES"; 
(Cut-off values}! Lower than 1 mlUmil 
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(Oommsni): Take measurements again 2 weak later. 
(Cut-off values): 1 miUM or WflhW 
(OommBrM)! flee yejir doctor at our hospital within a weak. 
If yew mm to preliminary question e is "VE8": 

9 (Cutoff values): Lower Hian 0.5 rnlWml last time, lets than 6 mlUAml thfa time 
(Comment); Take mettsuroments again 4 waste laiar. 

(Out-off vakiee): lower than 0.6 mtu/ml last time, 0,6 mlUfori or higher (His lima 
(Commenljs Sbs your tfnoior at ihe hospital within a week. 

(Out-otf vaTuae): 0.&mlt//ml or higher lost tline, lower, than previous measurement this time 

10 (Commant); Take measurement* again 4 weeks later. 

{Out-olf values); Equal to or blnjier than 0.5 mlU/mt Inst tlma, equal to or higher ihen previous rneasurament 
mistime 

(Oommant): $e? Vow doctor fit our twits! wlihtn a week. 

Now the mediae! measurement apparatus 10 of the Invention te Illustratively operated will now be 
re dstotibad with refsrenoe to the flowcharts of tfg. e (ooniroller'e operairons) and Flo. 7 (operator 1 * 
. operellone). 

\tftM\y, m controller euoh M fl doctor with tpeolalfcted knowledge eats up ttie medloal measurement 
apparatus to by Inputting thereto various meatfiiremsnt-relatsd requirements such as maeeurlns Kama and 
criteria tor Judgment for Individual aubjeote. 
eo . In th.o exampla of Pig. 6, the controller first entera an IdenHNonilaJi signs) suoh as his password number 
to got (tie apparatus ready for entry of the measurement requirements, Than with asoh partlouler sutojaot in 
mind, ihe controller entero Into the eppamiue the sublsot'e-name (pailant'e name), the subject's it> code, an 
Hem or Itome of measurement, criteria (out orl vsWbb) for Judging maasuremente regarding tr» specified 
measuring Itemfs), comments la bo issusd when the measured results are above or below the out-off 
u values, Ihe date for alerting measurement, the dale for ending measurement, a parmliied period tor 
meaeuremsnt, end ihe exeoutlon or nenexeouilon or a tweaeutfng lime alarm, etc. 

if the controller does not enter spealilo values or comment* for any measuring Item, tha apparatus 
eaitomatloalty establishes preset data by default, 

These eettlrtga and entries are made by nee of the keyboard 1 $ etleohed to the oonlrol unit 14. All data 
w entered through tha keyboard IS la displayed on the display unit aa for verllloatlort (this also applies when 
tha pattern operates the apparatus, as will bo described later). 

As already daBorfbacf, these settings and entries may be recoiled and altered as needed by ins 
controller. 

each ol ftm ejilrfes |a atoned into the eoHflspimdrng memory In Ihe oontrol unit body 1 B, For etfample, 
as the patient'* name end the patlent'e ID code or* etored Into the memory tor tha tttaniHloalton'moane; the 
measuring Heme, out-off value* and comments are etored Into the memory for the criterion setting means; 
and the times tor starting measurement are stored into the memory for the vorffloatton mesne. 

When the medloal measurement apparatus io Is set up In the above manner, the apparatus Is ready for 
uaebylhepatlenl 

40 ' When ihe medloal measurement apparatus 10 elans to be used, an alarm marking the time for sterling 
measurement Is eollvefed If the controller has M the apparatus for alarm aouVatlcirt. With the alarm 
activated, the apparatus enters a etertup slate, 

to Ihe start-up effete, ihe patient (subject and operator) enters tits name, m ID code end the relevant 
measuring Hems, when a given. Hem is entered, the control unit body id relrlevea the (tern from the 
40 corresponding memory for display and verification. 

It any entered Ham Is not oorreot, an alarm beep ts sounded and the etert-up state le reaohsd again. 
Whan the entered Hem Is oorreot, tha patient's past measured results ot (tile Item are displayed on the 
display unit 22. 

The date of measurement Is verified next. If the entered date Is not correct, ihe alarm basp Is sounded 
90 and ths start-up slate Is reaohad again. 

Whervthe entered date of measurement fe oorreol, ihu display unit 22 gives e comment saying that the 
date le oorreot. A epeotmen la than supplied to the measuring unit 12 and measurement l» started. 

The output signals (eleottloat signals) from the measuring unit 12 are sent to the Judgment and display 
means o) the control unit body 1«. 
«s Trie ludgment and display means, for tts part, computes measured reaulte from the received oulpul 
signals, selects the relevant oommani based on the measured results and according to the criteria for 
Judgment and displays Dte odmmenl on the display unites, Atlhe same lime, the date of measurement, 
the measured resulls end the other related date ere stored tola ths etorage means. 
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Alternative way* to operate the metiioa) measurement epparaluB 10 of IhB Invention will now be 
described wlm reference lo the flowharle of Rg, 8 (controller's operations) and PJg. Q (operator's 
operations), These examples era ones in which preliminary question* m put to ihe person operating the 
apparatus end the apparatus proceeds with measurement m aoooKlenoe with the answers given 1ft reply to 
o fhese questions, 

The examples In Ffge. 8 end 6 are primarily Ihe same m ihose'of F!ge. e and 7 exoapt that ih* 
preliminary questions #re asked. Tfin description that follows will «snter'on the differences between the two 
groups of examples (ihe earne will eleo apply to examples of Figs. 10 through 13 to be explained lata*), 
Trie controller, us In the earlier examples, first enters ihe patient's ID code or tltiar appropriate 

n mmmWon data, « wall as preliminary questions and comments about possible enewere to ih* preilmf- 
nary question* flutfemsnte). Later, Iha operator enter* th» measuring «em(s) and trie pallonVe ID code to 
cheek II the entered Item Is correct In this example, the Input of the patient's name Is replied by that of 
tha patiantle 19 code and la thus, omitted. Than a oheok !» metis to m w there m any preliminary 
questions thai have been tel. If such questions, exist, they m displayed on the display unit M, The 

« operator enter* answer's to the preliminary queellons, and proceeds with measurement by following 
predetermined procedure* or In accordance with the Inalruollone from th* apparatus, as ehown in the 
flowchart. 

Other alternative way* to operate the mBdlDat measurement apparatus 10 of the Invention wilt now be 
deicrfoed with reference to the flowchart* of Fig. 10 (controller's operation*) and Fig. 11 (ope/etor'e 
» operations), These examples are ones in which the «etllnge of measurable dates and times vary with (he . 
measuring items. 

The controller unloose the hardware (I.e., control unit body 1«") "sine We password number or id code, 
and enters the patient's ID code, (he measurable Items, measurement starting date, and oihar appropriate 
settings, In this example, the eefltog of the patient's name Is replaced will) the patient's ID code end te 

m omitted. Then a check Is automalloally made to see If each measuring Item 1b correct. The manner of 
oonduoitog the eheoK Is th* «*me w lhal discussed ebeve lit oonnsoiton with attaching the measuring chip 
(I,e„ analysing section J8& or output eeollon 1Sb) to the medloal measurement apparatus 10. Th* comment 
to be displayed fit any measuring Ham Is stored In advance. 

The operate/ oonnecie the measuring ohlp to the system and *nt«» the patient's id cods. Trio system 

so then verHlBB the patient's ID code, (he measuring items (automatically Charted by the manuring ohlp its 
mentioned), and the date arid lime of measurement, and passes fudgmenls ihBreon. Where necessary, ihe 
dlsploytinlt 3£ displays oommante relevant to these Judgments. When all measuring conditions are found to 
matoh the set conditions, the operator proceeds wlih measurement by following predetermined procedures 
or vcaardlng to the Inaliuotfane given by the apparatus. 

es Further altemaltva ways to operate the medical irmeurement apparatus 10 of the Invention will now be 
described with refereno* to the Wowonarto of Fig. 12 (oontraiiBr'e operaiione) end fig. is (opsrator'e 
op?fatlone). Theee examples m ones In whloh the medloal meaeurement apparatus 10 Is cannaotad to the 
boat computer 100 «n file coiWoller'e elite and lit whloh the oubofl voIubb for fudging measured results are 
. raolaoed by numerical opsratlan expressions for cut-off purposes. The measured results are Judged based 

40 on the computed value*, end comments ere displayed eaoordlngty , 

The controller unlocks the software of the host computer using tils pasewerd number or ID code. If 
there exists data representing past measurements, the controller may examine that data. The oonlroller then 
apBBlllee either new. entry or entry modllfoatlon. If any of the owed settings need to bo mottltted In 
ecaordartoe with the result of examination of the pallent's dais, the oonlroller alters the relevant measuring 

« Heme, ouboff numerlnal operation oxproBSlon* end other setirngs. For the new entry of sefllnge, the 
controller Inputs a new patlenVe name, measuring Items unci olher <teta. The coniraliw then focte the 
software, 

the operator oortneota the meBaurlng chip to the apparatus and enters the pallsnfe ID code. This 
oeuees the apparatus to vortfy the pttllent'e © code, the mBaeiirlng Items (eulomatloally cheeked by the 
eo measuring chip), date and time of measurement, and other settings. Comments relevant to the fudgments 
, by the apparatus are displayed on the display tirrlt i&> When eil oondltlorts ere found to matcjt fh» est 
condltlone, the operator proceeds with measurement by following predetermined procedures or aooordlng to 
the inelruotlons provlditd by the opparatus. 
. Other alternallve ways to operate the medical measurement apparatus 10 of tha Invention will now toe 
es deeorlbsd with referonoe to typical displays on ft* display unit 22 shown In Pig. 14 (a control panel In effect 
when the oonirolter eiaits entering settings), Pig, Mr (a conirol panel In effect whsn ihe controller entere 
MenwromoriHelataal 8«r|tlnns), Fig. 19 (a oontmr panel In effect whan the operator starts measurement), 
and Fig. 17 (a control panel showing the controlter'e oomment when the operator ends measurement). Tf» 
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medical measurement apparatus 10 shewn Illustratively herein haB fin LOD acting 88 a control panel on the 
display unli W {Fig, 1), The keyboard may be used 1o enter character* Into the Held* artd th* mouse may 
bo operated to manipulate push virtual buttons on the displayed oomrol panel. 

When the' controller starts an.Bntry procedure by activating a group of subject enlry commands, the 

e display unit £8 display* the control panel of Pig- 14 requesting the Input of the. controller'* password code. 
When (he controller 1 * password cod* le entered through ft* keyboard and ft* "OK?" button is clicked with 
the mouse, the oontrol unit compares the fenui ood* with the stored password cod*. If In* Irvput *wh> l» 
found (o oolnolde with the stored pas word node, the display unit iz displays the control panel of Fig. is 
for the tintry of aaltlnga. If the Input oa de and the etored password code fall to colnolde with oaoh other, the 

io start-up state Is reached again end another Input of the controller'*! pseeward code Is requoalsd. 

The oontrol panel Df Fig. 1tt oomprisea a *ub)aot (patient) name Input Held,- a subject IO (password) 
code Input field* a ring switch for selecting ihe tergel enatyte to tit* analyzed, an entry date Indication llBld, 
an entry lime fndl&alloit field, « ortterton {out-cff) setting elide switch, a comment Input iietd for giving a 
comment when the measured result Is equal to or higher then the criterion, a comment Input Held for giving 

ie a comment when the measured result te lower than the applicable criterion, a .ring switch for setting date to 
permit start of meaeuwment (day, wontr*. year), a ring ewiton for setting date to permit the end of 
rnewurerrlent (flay, month, year), a ring switoh for eattlno a day of the v/eeft on which to permit 
meaeuramBnt> a ring switch for setting a measurable time range, an alarm eetlfrtg push button, an entry 
' verJIIoatlon push button, end an Input field In whloh to enter the controller's password code at the lime of 

to dels enlry, 

In the Sample of Rg. 1B, a patient named "T. YamauohV te entered with a code name "CHU1." The 
target analyte to be analyzed Is set for "urine hCQ" end live criterion for measured result Is eat for "(0 
1U/L" When the measured reeufl exceeds the established criterion, the control panel ie set to dlBploy a 
comment eaylrtg, "Oongratuletlcne. You are probebly pregnant. Contact yow<|ooior as eoon as possible el 

no the M hospital {call 03-XXKX-XXXX)," Whan the measured result la lower than the applicable oilterton, the 
oontrol panel la eet to display a comment enylng, "You m probably not pregnant if you ere In doubt, 
contact your doctor any time at the- M hospital (call oa-XXXK-XXXX)." The data ott whloh measurement te 
allowed to start fa sal far "Now" The data an whloh measurement le allowed to and Is eet for "Oolobar 61 
tills year. 1 ' The day of the wsoh on whloh to conduct measurement Is not reBlrfoterf, whsreae lh» 

do measurable time range ts limited to the early morning between ion and BiOQ. Trie alarm l» tunned off. 
Whtm these settings arc entered end considered eatlefaslery, the controller enters hie password code and 
pushes the "enlry verllloatlon push button." This onuses the control unit 14 to store thB settings Into the 
storage means. 

The operator, for her part, operates the control unit 14 on the basis of tha settings entered by th* 
as controliar. The control panel of Fig, 19, In affect when the conjrol unit 14 slarta measurement, presupposes 
that the operator and the subjeof are the sama paraon. That ts, when the central unit 14 elart* 
measurement, the display unit & displays the control penal of Fig, 19, This control panel comprises a ring 
awltoh for selecting tha subject name, a subject password cede Input field, a measurement data Indication 
tletdi a measurement lime indication field, a ring ewltoh for selecting lha large! enatyte lb be analysed, a 
■ io measured result Inrjigallon field, a graphto Indicator tor showing measured results, a comment Indication 
field ("Remark*" fl*ld), a graphic Indicator for showing her past data, a ring ewltoh for determining whether 
or not la save measured results, and a push button for deciding whether or not to perform the nexl 
measurement continuously. 

' The apsrator cannot start measurement gnlese ha eeleots tha patient's nemo, enters the oorreot subject 
« to code, and chooses the target enatyte allowed for measurement. Furthermore, the Intended measurement 
cannot be started If It does not fall on the date of measurement authorized by the controller or within the 
psrrnltted time rang* For measurement When tha entries made by tha operator are cornet end satisfy the 
conditions set fay the controller, thB graptito fndloator for showing past data display* the subject's past 
measurement data In the form of a simple line chart, with the "Remarks" field giving a measege prompting 
eo tha operator to start mseaurement. If tha intended measurement le not permitted for some reason, that 
reason le- displayed In 1h» "flemarx*" field and lha control unit (alums to the start-up state. When 
measurement Is permitted, the operator gota the HOG analyzing section (shown in Figs. 3 end 4) placed Into 
. tha measuring unit (fteowse "urine hod" l& ssieoted as ihe target anatyta to ba anelyaed for this example), 
Introduces a urine specimen Into lha analysing section, end elarts measurement. The measured result le 
6* displayed live minute* later, end th* "Remark*" iieis display* a controller-**! relevant oomment In 
accordance with the criteria set by tha controller. 

When measurement Ib ended, tha display unit Be displays the aontrol pans! of Ffg. 17. In thle example, 
lha measurement taken le arjQ IU/L, a value exceeding tha applicable criterion. The control panel tlwa 



BP 0 604 676 A1 



displays a comment aat toy the controller in advance saying, "Congratulatlone, you em probably pregnant. 
Contact yourdootor aline M hcepHeJ (cell 03-XXXK4OOOQ «» scon ee possible, 1 ' 

Typical operating protr«tfur«» of the medical mwwramem apparatus 10 of ihs Invention ae well as the 
Internet wcrfctoQ* of tn* control unit 14 will now be described with referenda to Pips. 18 (ion ih& controllers 
» side) and Hp, 10 (on the cpmWs *}de), The optlfUont. In Fig, 18 correspond Id the flowchart of Fig, e eg 
well aa to the control panels (displayed on the dlepfay unit 2£) of Figs, 14 and 10, end the operations tn Fig, 
Id correspond to ihe flowchart of Fig, 7 as well ae to the control panels of Figs, 19 out 17. 

Whan tha controller starts art *rttry procedure .(>/ aodvatfrig a cro«P of subject entry commands, the 
control wilt 14 (or host oompuler) entere en operation mode shown fit Pig, 10. The controller ID code 

w entered through lhe keyboard la compared by a comparator 110 with 1h» controller roglstrallon code etored 
In the storage mesne, to case of a match (a "true 1 ; output from Ihe Oomparator). en AND gate 1 end an AND 
gate a era opened, The conditions entered and eat from the keyboard 18 and from the push button 
ewltofiee and elide ewltohes Oft the control panel are tent past the AND gate 1 for temporary storage Into 
memory (RAM), When ttie "enter?" push button to clicked, the output of the ANf> ©ate 2 becomes "true" 

« so «« to open en and est* 3, The s&ttfne* In ihe temporary memory are thBn w/lttsn to the applicable 
regions tn the eloreae nwena. 

Meanwhile, when lite operator starts a group ot measuring commando, the oonirol unit or host computer 
' enter* a measurement mode shown rn 10. tn the measurement mode, the output ot current time data 
from a built-in timer In the oontro) unit H la acmpejed by a oomparator 112 with the settings of 

iq measurement dtile end time data stored hi Ihe storage msans. If ihB output ot the current lima data from 
the timer falls on the allowed date and within the allowed time period, the comparator 112 outputs a "TVue" 
signal to open the Atf D crate 1' and an AND gate 3. Where the controller set alarm activation beforehand In 
the storage mesne, the opening of the AND gate 8 lurna on a tourwr or other appropriate type of alarm, 
When the subject name le relented by uee of a ring switch on the' contra! pane] of the oontro) unit 14, the 

*« opsnlng) of the AMP onto 1 le BMompattlBd by ihe retrieval from the storage mm of tho patient's name, 
the patient's ID code and ihe relevant measuring iteme In accordance wllh the ring swl'.ch for the selected 
subjeol'e name. The patlant'e 10 code thus called up le oompanafl by a comparator 114 with ihe subject'* 
10 oode entered from the keyboard. If the two codas coincide with each other {a "true" output from the 
oomparator), the and gate 2 le opened. With ihe AND gate s opened, the measuring Item selected by a 

ao ring awitob ma the previously recalled measuring Item are compared by a oomparator lie. if the 
comparator 110 effects a "hue" output, the output enables a awJloh lhat oHuees the Inetelled measuring unit 
12 to atari measurement. Thie lit turn trigger* the rettfeval from (he «torane mesne of the criterion (out'Off 
value) 0 end the comment tn effect when the measured result taken Is lower then, equBl to, or more than 
the cut-off value In accordance with the ring awltoh for Ihe sclented target analy le to be analyzed. 

ss Although not shown In fig, 10. past measured reelilt* are retrieved If the oomparator 1 16 effects the 
"True 1 * output, Tfte output of lite comparator lie opene Ihe AND pete through whloh the past data Is 
displayed on tha control panel. 

. When the operator' lnet>1!$ Ihe measuring unlt'ta, fntroduoee a specimen Into the meaeurlng unit 12 
<l.e„ analyalng eeotton m), end turn? on the measurement atari ewltah (Indlaated by numeral 122 Irt Fl», 
1fl). TMIs causae the measuring unit 12 to Btert tneaeurement, The measured result ot the target anaiyto re 
computed from the electrical signals supplied by the measuring unit 13, The value X le compared with the 
ouf-otf value C by comparators 1 1 8 ttod 1 80. Depending on whether X 0 or X < O, either an AND gate 4 
or an AND pat* 9 le opened. Then the relevant oommontsel by the controller ts sent (hrouQh an OR sate e 
tor display onto M control panel. The measured result el'ttte Inrget enalyto for anaiysle fa stored into the 
& storage means past an OR gate 1 along with suoh data as the patient's ID code, ihe measuring llewiB end 
the measurable time. 

In the oxamptea dletmaeed above, not all Items need to be elorad fnto a single storage means. The 
Items may be atoretl Irt a distributed manner In a plurality ot storage mesne, Alternatively, the g&ine data 
may be etored In duplicate fashion fn a plurality ot etorage means, The alternative way of storing Ihe eame 

so data In a plurality ot storage means le desirable from the standpoint el dm eeoirlly. Tfio storage mesne 
may at may not be attached Ifxedty to the control unit, The storage meane may be allocated In th» heel 
computer connected via communication linos, or may be of a.typa detachable from m control unll suoh as 
an IC card, as discussed earter. 

When the controller eet» oommnnds wlih respect to ihe meaevremBhts taken according to the criteria, 

as suoh command* may be formed tn (Ilea as command flroupe and atorad in ihe etarsge meane. The 
command grcupe, written In e language executable by the CPU of the control unit, may Inatude programs 
written Tn maohlne language, In macro oontrot oommands such as assembler, or tn higher level languages 
such a$ Oi FORTRAN and BABIO. It may be desired that tha 0*>U control devloeu built In or externally 
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attached to lite control unit. Syofl davloea may camp/las the meBsurlnflr unit, storage unit, . alarm, 
comrnunlceillon Interface, modern, facsimile machine, data I/O Intartaoe and reTay olroult in those cesae, the 
abova«m»ntlonael command grows are supplemented by other groups pf commands that or* epaoltlo to 1ha 
respsollva devlcw. For example, some devices are compiled by nee of command* associated with the R8> 

o 23EQ port, parallsl port or ©PIB bus. villous commends may be used cteptndlnj.on (lis nature of what 
reads to be oanirolled and on the typa of device to be controlled, Illustratively, there ara oommandB that 
we used to modify the preliminary questions, measuring item. criteria tor Judgment, the oommsnte and 
oommandB about the measured rcsuHe according to the criteria, find fli» measurable date and lima, These 
groups ol commands are furnished Inlllally to designate In the applfaabte storage unit the addreaa of tha 

10 soWnge desired to be modified eo that they may be updated, Far example, it a particular sotting of the 
criteria exists at a specific logloal addrese on the hard diBo in the control unit, thai logical address may be 
designated 89 a parameter 1, and commando for writing a parameter St (new setting) are preserved In the 
form 6f « preset command file, Although stioh command eraup* may be set originally by the contwller, It la 
preferable to prepare beforehand a plurality of (troupe of frequently wed commend* a* lllee Inside the 

« system so that the controller My simply designate ihe appropriate tile nama and parameters whan setting 
up the commands, lit the setup above, preparing oommande for modifying a setting of Ihe criteria requires 
Vnm thing*: epeolfylng a preset command file (oomprlBlng atomfls update commends), setting the 
parameter 1 to designate modifloallon of the criteria, and ashing ihe parameter St to designate the new 
setting ol ma criteria, a* m the oasa of the comment display dasortbed earlier, a comparator compares ihe 

io aul'Off value 0 Willi the measured result X about lb target analyte for analyst*, the Value X being computed 
from tha eleolrloal signals 3(m t dy ma measuring unit. The corresponding, commend ilia to be aat by the 
controller la retrieved from ihe storage mesne end executed. As dssorlbad, the simplest and the least error- 
pfaguen" mBthod for the Controller te tat oommand groups le tint to stow all commands beforehand In the 
storage mea.ne,.snd than to eelaot arty ol them In the form of a command file et the ttm a of the controller's 
. sb registration of the subject Into the apparatus. In this case, esleotjnpj * pturellly of files nausea ihe command 
groups (n the aoieoled files to be executed, provided the measured reaulie satisfy the criteria, The 
command exeouiton meant outlined above le only en *Kampte and may be replaoed by any other means 
by which the oonirol unit may execute commands. 

White a preferred embodiment of the Invention has bsen deewlbed using apeciilo terms, such 

ss description Is for llttietrail/e purposes only, and It la to be understood that changes and variations may be 
mad» wHhout departing from the spirit and edope of the claims that follow, 

EXPLOITATION IN INDUSTRY 

ss As described, trie- medical measurement apparatus uuaordlng to the Invention allows not only health- 
care professionals such as dootore but also test eubjeaia suott as patients and pregnant women as well as 
their attendants to readily perform medloat measurement In medical IrtetllUtlons or elsewhere (e.g., at 
home). Furthermore, the Inventive madtoal measurement apparatus parmlte health-oar* experts such «e 
dootore with spsclallwd hrtowladge to set appropriate comments about « given sufajoot wtlh respaot tQ 

*t> relevant measuring Items, the criteria for judgment and tha measured results. The Judgments as par the 
ojlterla regarding the measured results and the relevant comments oorr«spt»nc«ng to ouoh luctgments are 
output suitably by th& apparAlua. 

With this medical measurement apparatus In use, the subject staying at homo oan receive specialized 
medical flare, reansured hnovulng that he or aha Is undar epeolallstB* wpervfBlon. In addition, the use of the 

4tf measurements taken by Ihts epparatue elgnltlcantly helps doctors end other medical care wperlB In 
. providing appropriate mcdloal core to their patterns. 

otarma 

A medloat msaBurement apparatus oompifelng: 

a- measuring unit tor ouiputllng elaoirtoal slgnatB In accordance with the amount of a target analyle 
measured In 4 epaolmem and 
a control unit Including: 

identllloailon means for'retielvlnp WenHKoatlon data speoltlo to a> subject' and for Identifying eatct 
eubjeotan the bssfs Of SaW IttBhfllloallan dalaj 

Criterion setting means only .(or by a controller #o sets comments about measured resulie 
regarding the measuring Items and the criteria set tor eatd subject end who le capable of mahlng a 
eponlallzed Judgment on the amount of said targat analyle In said specimen; arid 
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Judgment and display means for computing the measured resulla based on sold elsotrlcal signals 
from em m&mm unit end for <eleo«v*ly displaying the comment wlovant to eald criteria with 
reBpadt to the oomputad measured result*. 

a. a msdioal measurement apparatus according' to oialro 1 , wherein satd Identlfloiillon date le eo» only w 
eald controller. 

9. A modfoal measurement apparatus eocordtoji to olalm t or a, wherein satd control-wit includes stomas 
niBBjis far storing a plurality of measured remits, and unwell) said controller retrieves thB etorod 
measured results ee desired, 

4 A madloel measurement apparatus according to claim 9, wherein suit* storage means stares the 
meswrcd results with respeot (o whloh said criteria are modified as nescied. . 

6, A medical measurement apparatus aooardlne to any on* of claims t to 4, wherein said control unit 
Include* either or both of tjussttonTng mean* *nd verlltoatlon meane, said questtonin^ means bBfng 
need 10 put pjallmtoBiv questions to eald subject (n connection with said measuring itamB, said 
verlltoatlon moans fcolno ullllied to verify that measurement to performed under the measuring 
conditions established fn aooordanoe wiih eald. mmmm items, and wherein only said controller I* 
allowed to oof saw preliminary questions end eald measuring condlttone. 



$, A rnedloa) msaewament apparatus aoooKtlnft to any one o! claim* 1 to 9, whereto aaltt control unit 
■Includes time- stamp setting meariB for setting tlmwoounTed time stamps to msaetiro to kasplnp with 
said meaeuiton Items, and time stamp verllfoatlon means for verifying that a given msaeuroment was 
taken at the ODrrespondlnflly art time of day, and wherein only satd controller la ellowod to set satd 
lime stamps, 

7. A medical meaeuremenl apparatus according to any one ol claims 1 fo 9, wherein said criterion esttlng 
mesne In sold control ttrtlt Is erraneed to est commands either In pte.ce of or .In conjunction with aald 
comments, and wherein salt) judgment and display means is either replaced will) o; supplemented by 
Judgment execution means far eatecilvely BHaoullrig said commend^ • 



26 



BP 0 904 675 A1 



I 



E*» 06B4 676 A1 



FIG* 2 




hp omenta 



FIG. 3 



so* 




EPDQB4676A1 




BP 0604 676 A1 



FIG* 6 



Brvijry operations 
(by Controll*)?) 



[input controller' 



> t input WlanW n«n«f ~A J JJ j* 



•i 



H^ftpafc cut~of* values}-* 



* j ■ ■ L 



input patient's ZD 



Input comment to be 
displayed it 
mMMM result in 
lower than out-ofl! 



input t 

displayed if 
* tneasiiKBd xesuit in 
•dual to or higher 
t% yft-fifo value, 



Input date to eta'rtH 
mgwj>re»ent 



4 
1 



input date to end 



iwt »eaauK«b)Le 



H 



|8peoify u"ise>iw'nuBe'"'' 
if alarw 



Btoste 
Input 
oontenti 
into 



Entered patient* i 



ftelewed 
measuicin? itetne 



cut-off values 



oantftetot to be 
displayed it 
measured tesult 
As X>mt than 



^jBWient to be 
displayed 1* 
sieasuxed sesult 
ie eijuai to or 
hitrh«K than 
WffW Yjjrtff ■ 



Data to Btatft 
measurement 



sate to end 
roftawKemant 



Measurable time 
ittftge 



use/nomine of 



31 



BP 0664 676 A1 



FIG. 7 
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Deealplton tloftHonofortslrtflltfoeuiiiftntsorolsolroiilomsiBmwBes- 
as. There iBamucfioreaterneed, however.fof a rellabto 

[0OO1J The pwsent Invention relates to a system for e^emeto«Uthem!oRtftahQKl«)pyof&norlfi!nMdoo- 

ntofclnn and authwillpallng a oopy of an original doou- utnonh The various eoherriBB described above epplloa- 

ment 1 * bieto original documents would not apply to a copy of 

I0002J It (e known how to aulhenlloaie original doou- 1he document, or at least would notlaava a rao&lvar of 

ntente using 0 digital elgnaltire. The latter provides a fiuohaoopywlthahtanievslofconRdenoethaltbBcopy 

wntque pallem baaedonthe dtgltteed dooumonltoxlantl in his poseaaaton t», 111 foot, an exaot duplicate of soma 

a imtouo signing hey (or sonnet key) of the document original dooumenl located at a distant place, 

creator, Whenlhaorigtnol with attfloh»ddl?lt«t«!enfllur« « mm A major objeot.of the Invention !» o system for 

Ie(fansmlfted(0leii1[on!ofllly oraBahardooj)y)to«iht«l maMngoraulhanlloallnn ahard oopyof an original doo- 

party, 1h s latter through digitizing and professing of the umenl. Aulhentloatlnp a copy means verifying (hat Ihe 

rafietveddQcumBntonddlaltaUlanaturooarKtetermlne otipyourrentl/tiUbeiioaBeafllonoftriereMlverlelnfaat 

whether lit* document Ie (temilne. Idenltoal to an original dooument Irpm whloh th & copy 

10103] Ways Of providing tifglfdslgnaujreB of original to was prepared. 

• dooumwte are dsacrlljetl In U8P* 4,881,264: 1001*1 This ie achieved, In aooordanoe wllh one as- 

■ 4^00 ( fiflBi4,e2S J D7ef 4,BBe.4^antfo1hBrwla(edp5it- p«atorin& invention, by making a copy of the original 

enter Tfte digital signature, In affect, te an encoded ver- dooumant on a copying nwohlns- that al*o generatee 

eton of the entire document, reduced to a unique mark- from the original adlglta) signature that Is affixed to the 

lng.addsd a* a eeat to the original dooumant. if thsorig- so copy, coiwtltutlnn, a digitally signed copy of the original 

Inal domiment or Its signature Is madlfiad In any way, document, the digital Informallon can be lr> human- 

ihoalloratlanswlll badeteoted when the document arid readable or encrypted form, 

signature are checked wllh tns appropriate daoodlng [0011J in aocordanos with anolhar Aspect of tho 

toy, prostint Invention, In Ofdartoguardntae thai the euppltBr 

IO00«l The firet of tia above^OBorlbad patent* de- « of the original document aulhorlrad Ihe rnalrtnfl of the 

eorlbee a dual-key or public Key oryplosiratem for gan- signed copy; Identifying Informallon unique to the eup- 

eratln9«dlflllaletcnaluwofadooumsnt.lnthlBay«tom J pller may ob required before the copying maohlne 

IhoailgrnatorororeatorueeBa private oreeoret signing makeetha atoned copy, 

key for proosastog the doouiftenl by a particular alge- [CM 2) In a preferred embodiment, a apeola! Key 

.rlttim to generate a "efonalur*" represented by a ee- iq known only to (he aloner or dooumentorlntoatorts used 

ogenoa of bite ranging from several hundred to several togenerelothMtgnedcopy.AeeoortdspeBleilkeyneea- 

thousand depending upon the particular system ubbu ed to ohwk the etgnen copy oan be indudBd tn the 

andtliBtevelofeeourlly<feBlrad,Tiie»eelrarofthedlg. elgned copy. 

Ital signature would poaseae or ba glu an a otocklne or loM 3] in aooordenoe with a further aspect of the In- 

public key, mathBtnalloally related to the elplng key, « venllon, allme stomp oan aleo be Inoluded in tho digital 

whiohoanbetlseoltoprooeeBlhedaiiuiTientlhraugha - stature. 

toldled atgoillhm to datermtne whether the renetvad {0014} the Uive-prodimed elgned oopy oan than be 

doDumenl me, Indeed generated with (he aulhantlo faiwardadbyanymeiinaandtiyanyperaQntoareoelver 

efgnlno hey of the creator. If 1h& oontente of thtt doou- at a location, usually d&lant, where fiw reoelwer need 

merit «re to be kept eeoret, then It oan be separately w haw no access to the ottgrnat doDumsnt, 

enocded and decoded by onoofmany known onoodlnB The reOBlvertrien proB»»as trie elgned copy 

and enerypltoneo'tiemoe. throuflh ftelmllsroopylrig maohlrtBlhathantheoBpabll. 

tOOOW One company has tteeorlbed' a ecoalled time lly of storing the unique Identifying fnfo;matlon of the 

' etemp eeal (ehm to a notary seal) representing a dlgitat sender, or of deriving from the signed oopy, II Inoorpo- 

slgnaturaofthBdooumentplueftUmeetampiomarkthB <ia retedth8reln,thountqueW9nllfyltig Information or relate 

time whan the document wa» reoalved end the digital ' ed Information, euort as a checking key as previously 

signature moofvM USP6.001.7M daecrlbealh detail dseorlbBAThereaullBMprooeBelngprfivideBan Indlott- 

anolha* veretort Of 0 llmtt notorfsatlon syetetn. Hon of wheftior the received copy la an aulhentlo copy 

jOODej Anoiher company omphaslieB (he publlo Hey of the original, The Indication oould lie as ermple as a 

cryptography ayatem ae a way of achieving a temper- « . Boolean outputon the machlne IndlDatlnathaprooeeflad 

proof digital elgnaVo (hat can be used to MtaWtflh the- dooumeril Ie valid or Invalid. Alternatively, a nWtttsgo 

amhentlolly Qf eleolronlo malt mtMBaget. oan be dlepteyad on the maohlne or affixed to a digitally 

tOOOYt U9F> 4,600,076 dostrlbes a echeme for au< cleaned copy of the elgned doqument that would Itldl- 

thentloallon of an Identifying tO «ard employing a per- cate that the clemoa copy loolfO like an original doou- 

• aortal ideniifto'aiton number tPINiforoheoklnrjtho valid- w mantthatwaa oopledby a named Indiwtdualata oartaln 

lly of a card holder uelng a Data Enqrypllon Standard time and datB. 

(PES). [0010] fnOQoordanoe with one aapsotot.thslnvenllcn 

(O00»] TheemphHBlBlnlhBftrthasbcentheauthert- iherela provided eeyajem for authentloallnj hard oop- 
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les of oilglnnl dooumenls oompits'na (o) a copying me- 
ohlne, said copying maohtne Including, 



[I) means for receiving from an entliy an original 



II) means for generating a digital elgnattire from a 
doouM4nt> 

(III) mean* for reoatvlng liYformattoii uniquely Iden- 
tifying We ertlHy supplying the original document, 
(flr) mesne for Incorporating In the digital signals 
infomiMton representative of iho entUy'etdenllftoa- 

•110)1, 

(v) means for protfuolng « elgned dooument flrat 
copy InsoraoMitlng Iho digital signature. 

[0017) In one embodiment |h» Aral aopy produced by 
me8(iBor(9)(v)!saii6tiorvptfltlcopyof1hB()rialra)<<oo- 
untent, 

[POi B] The digital signature may In differing embodi- 
ments b » either visible or Invisibly. 
(00161 Thepre89ntlnven1lonwlllbe((»sorlb»aruHher, 
by way ofexempte, with reference tethe accompanying 
drawee, to which:- 

Flge. 1A end 10 ere schematlcf views of examples 
of document aulhenKoalloit sohemeB, some fea- 
tures of which may be uead In lh» system of (he In- 
vention; 

Pig. 2 Is a echemallo view Illustrating operation of 
the system In accordance with one embodiment of 
the Invention: and 

Fig. 3 Is a btook diagram of a oopytrw machine us- 
able In aeysteni In accordance wllh one embodi- 
ment of the Invention, 

10024] Informalton mtegrliy has been a' persistent 
challenge now for several decades. For example, In 
(ransmlHIrui digital Information, a ohsDheum based on a 
eomputellonofthedlfjItallnformatlonlnstwoKlaiioewllh 
eome arbitrary algorithm could be added at the end o» 
the transmission. The receiver of tha digits! data would 
perform the seme computation and then compere. He 
computed cherjawm to that Included Inthetranemltted 
data. Any discrepancy indloates that Ihe received data 
' Is riol ai> exaol replica of the transinllted (Jala. 
[0021) Any document oan be digitized In any of eav- 
efa! Imavmvvttye, for Instance, irthedooumeritle wholly 
of text, It can be converted to a Blrearr) of ASOll cedes 
srtd BUbsequsnlly (Hjlllmtl. ir, InBlead, non-slanderd 
textual symbols are wed, or norete^uat, or graphical 
informi-llon Is present tn the dgournsnt, the dooument 
oan. be digitized by known eoannlng processes based 
on black/while or dark/ilght transitions. That strewn of 
dlgliel IhtWmalton representing the dooument oorrtsnle 
oah be subjected to a checksum, hashing or elmllar al- 
gorithm orfutiota whose output would then represent 
theaotuat full contents of thedocumenl. Similarly, digllal 
Information ean be encode* end digitally signed. Both 



thedlglfflllnformattonandthedlgltal signature can then 
be encoded end printed onto a sheet of paper. The Irv 
formation encoded arid printed onto the paper can In- 
clude; forexflmpte! description of what te printed on the 

9 dooument (allowing verilloatlon of dooument content); 
(leBcrlpHoiiBof the physical naltireoMw document (el- 
towing oonfrolled copying end dlslrlbullcrt of the doou- 
ment): or description* of programs thataraio be loaded 
Intoendekeoutedbythemaohlnoreadlnofhedooument 

W '(whether that maohltto be a PAX. oopler, eoannsr, etc.). 
[0033J Those efforts have been foouesed en estab- 
lishing the auluantlclly of original Information or date. 
For example, adding « digital signature to an original 
dooument oan be used to authenticate the original. 

« [0033] Encryption ta another teoHntque for enuring 
Integrity of transmitted Information, often used nowa- 
days for secure eteolronlo trturtmlaalon of dale or for 
m'slLManyenaryiptloneflhemesarehnowAandare treed 
today. One of the more popiilarsohomee uses the dual 

so 'publlrjfo!Mekey«yetei!t.Fl<|&. 1AanJ1Blllui1mtah(W 
auoh aeyetem ooyTd beemptayad toverify the eulhen. 
tlolty of en original dooument, euot> ae o ohssk or IOU. 
[0024) Referflng nowto Flge, 1 A and 1S 4 In tha piw- 
86* lltuslratad tn Fig. 1A, « desumBirt 10, which maybe, 

ff» for Inatenoe, an 10 J for $1 ,000, Isorsated «s enorfslnal 
rioaunisnt. The daaumehf 10 Is (Ueneoannsd and dlgt- 
tiled together wllh a secret elgnlng key pDesassBd only 
by Ihe oreater of the doourKierrt. Aftsr bslng prooeesBd 
by one of many well Known signing algorithms (nctlcstac* 

3ff at 11 , (he result te a digital signature wftloh oan ba tn< 
oorporatad with the dooument or ae pari of the original 
document 10, The original dooument 10 with the digital 
signature Is tndleated sH2, separate from er inoluded 
as part of the dooument 10, The fatter oan thon bBtrana- 

st ftilttail to o third party who would poaaasa a putjtlo 
otieoWna key eounterpart to the secret signing key ««. 
part orthle knowh'duai Key asourtty scheme. The doou- 
ment wouldagaln be eoemnad and dtgllteed^ndthedlg- 
llal elgnamre 12 tegelher wllh (he publlo checking key 

40 prowssadvla aoheoklngatgorllhm10.Thls«lgor1ihm. 
of which etjaln a number are known, would determine 
whether or rot (he digital elfinetare reoolved cone- 
aponde te that obtained dlreolly from the original doou- 
ment end lhat the keys uaetf by the creator and by the 

46 third party ortiserpropariy match In aocordanoe wllh tha 
oheoklng Blgorlthm, The oulpul of the oheoldng «tgo- 
rllhm la a single bit, ImttoaJIng that the signature la valid 
orlnvalldJn en aotualembodlmentithaoutput Indicating 
an Invalid signature* could be a red light, or some other 
w otsarly visible Indtoator lhat itta signature felled the veJ- 
ltMonehetft, 

[002&J Fig, IBehoweaslmltersOhemebutrnlhlecaae 
the document 10 has been allered 10> by ohanrjlng tha 
amount of money listed on it. Whan proosssed ae (he 
m original unaltered document 10, the cheetdng algorlthtn 
would MIoate a dleorepanoy In the dooument or In the 
dooumont'eeouroe wllh an appropriate rnewaga as ln- 
dloatadatlBlnFlg.1B. 
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[003$) To the best of our knowledge, there does not 
exist a way of providing to a third party & hard copy of 
• an original donument Snd proving that that hard copy Is 
In foot an «x«t copy of an original document which ex- 
ists at Dome ciher laoatton, This le precisely whe re the 
Invention of (he present oaeo comes into pray. 
(00H7J Fig, D HiuaiMeeechemaJlrallylhs opsratlortof 
b preferred form of the system of the Invention for au» 
thenlloallno; hard oojdIbb «f d wumwile, In this preferred 
embodiment, an original document 20 Is placet! gn a 
epeblal machine Z8 referred to herein es a atoning cop- 
ying machine or copier, While hereinafter will be dis- 
closed an exempli) of the ayelern contents of a signing 
oopferthaf oan be used fn the Invention, llwlltbeunddr- 
etood that the onset manner by whtoh the signing, copier 
makes copies.*! dowmentft, or ganoratw digital eigne- 
iuraBof donumenta la not crlltoal to ihelnvefMon as any 
of the known copying and dlglllistog Bahamas oan be 

(OD2B] In thl» particular case, the signing oopler 26 
has the ability of not only executing a normal copying 
funollw and producing or outputtlng a bard copy of the 
Original duuument 20, but In Addition It has theablllty to 
dislike the document and generate a digital elgnaiura 
ofihatdoDumantlnthsmannerfltprevlouatydBBDrlbed. 
Thai digital elgnalure of the dooumant | n oTuc(ea every 
*l(inllloafitplooo of information on Ihedooumsnl, *» well 
' as tnformalkm ihet Is unique to Iris slgnefv wWdb may 
bo a person or a croup, such as a aaarel signing key, 
IO0S9) In Addition, (lie signing copter 2$ can Include 
the further feature that It has ihe capability of verifying 
ids idanfliyoftha parson orenllty (hat supplies the doo~ 
ument to tiro signing eopleri In this particular ease, we 
aBBurne that Ihe poeBweorof the document 20 Is a pep> 
eon named "John Doe". John Dosi has a smart card with 
which he oan activate the atgntnj} copier 30, The smart 
card can be ono of many different hinds oi wall known 
articles whtoh oan be inserted Into a atot in the signing 
copter, which In turn would rend certain dataonthe card 
representing the identity of that owner- to be inoonporat" 
eti In the digital signature that Is prepared from iheorlg- 
frail document 20, John Doe'e'saDrethey can be includ- 
ed In his smart card, ae well a* the signing algorithm 
and his publlo hey. Alternatively, (he signing algorithm 
oan p& Included lr> (he signing copter is. ■ 
[0090] That digital signature whloh now includes the 
IdentlHoallonoTthedooument supplier Vohn Dos (a now 
affixed aatotiiBhard copy produced bylheaignrng cop- 
ier maohlne 39. That hard copy, designated 3B, Is a 
"sighed document", meanings document whloh has on 
It In visible or invisible form a'digfUil signature 98 of the 
document contents together with an tdentllloatlon of the 
supplier orcrentor. Moreover, the original document zo 
oan be In human readable form, orenmy pled for score- 
oy, in whloh' oasethesignflddocumenm would ato be 
tn humenwRdable or encrypted form. 
100311 TheBlgnectdaoumenigSorhardoopyoantheh 
be forwarder) 31 by any known insane to a Ihlrd party. 
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such as by hand del Ivory, or by use of one Of the postal 
or other delivery aervloee. That signed document 3B 
when r««tvecf by the third party la again processed 
through a similar signing copier maohlne 26, What the 

0 s|gnlr900plsrmflohrnezSwoutddow]ihiheelflneddor> 
ument 36 Is essentially to dislike the oonlenls, end 
check the digital signature 30, 
[0033] A digital signature, by lis vary nature, requires 
(he sfcjnerto have for validation a publlo checking key 

« that Ib malhemalloally related to hts private key, The 
signing copier would obtain, by any one of aewral 
means kbowettd described In the lllwstwa, a valid copy 
of the signer's publlo checking key, At art example, but 
to no way (he only possible method, the atgnar'a public 

f s cheeking key and a "aertlllcate" for Ihe slgWs public 
ohsojttng key eould both be Included In the original dao- 
ument In computer readable form. The signing copter 
26 would read both the oerttf lasts and the publlo ehedk* 
Ing key and would validate the wHflwIe and publlo 

so chocking key using a well known PtttiH&Cheoklnp. Key 
(whtoh oan b& owned by ths ooplermanufaolurer), Hav- 
ing validated the publlo chocking key of the signer, the 
digital signature of Ihe signal* and the validity of ihe dig- 
its! Iiformudort sighed by the signer could then be 

a oheoked.. 

[0093} AllemallvetK the public checking key of Ihe 
pariloular etgneroould be made pubiroly available, as in 
a directory orlhellke, and accessed by the signing ocp> 
lerSS, 

bo (0044] The oulput from the second signing copier 
used by the third party would typically be a digitally 
olaanad document 40, rnaanlns a hard copy Of Ihe 0% 
Inal document BOfraBof any phystosldlri or Image fttiz- 
inoBs introduoed dutfng tiandllng and prooasBlng of the 

ss original or signed docuntonU This le readfjy aooom- 
pllrthed beaaus.e the Information needed to olean the 
copy and restore the original was digitally encoded on 
the copy and ihua the signing copier oan readily deter- 
mine wlial the original document actually [coked like. In 
.addition, therecan be imprinted on the digitally cleaned 
document 40 by Ihe signing copter a massage Indicating 
that the digitally cleaned dooumerit 40looke lllto an orlg- 
tnaldoaiimentthBtataocrtfilnllmesndonaoerifllndate 
was ooptedon usfgnlrtgooplarmaorilnewllhthe author- 

t9 tealton o1 John Doe. Ailornatlvsly, (he message can bi 
omlttadffomthijdbcumentandlnelflftddteplayadonihB 
machine. Ttin machine could be readily programmed 
riot to make hard ooplss of signed dooumsnte unless 
Ihey have been propeilyverllled In woordanoewllh the 

s» invention, In (hts lattercasaithlrdpartlosoruBerswould 
know that any copy produced by such a maohlne from 

• 1 ttelgnad dooument Is tdanlloal toan otlglnsl signed dor> 
umentat some other looatlon. 
[0036] As mentioned previously, there are many 

ff» known ways by whtoh (he various functions described 
above nan ba Implemented, and the Invention Is not lim- 
ited to the speolflo means by which the digitization, op- 
tical copying, comparison eyctcmB, and other verifying 
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features era Implemented. Fig. 3 show* echemaitaally 
ona relatively elmpla maohlna fiSwhloh wDuld have » 
epaoa, aay, on top for raoeMng a dooumenl which may 
be an original document 20 or a Binned document 36, a 
keyboard 60 for kaylng ' In appropriate commands or in- c 
«lruotton» to the machine whore news wry, and a con- 
ventional card Input devlca 01 through whloh an ISontl- 
fleif objeof, auflh air a amart card, cart bo paeaed from 
- whloh Information concerning Iheeeoret elanlng toy and 
othartntormatlonoanbavatlfletJbyoonvBrillorifllmaflnB 10 
Indicated In Pig, 9'i>y block 62, The signing ooplar 26 
would have the mubI optical oopylrtg moans 64 whloh 
would beoapableof making a oopy era dooumant. Thai 
copy could, be a llteralflopy of tho document. The exact 
form le not Important to the Invention. Tho prooeeBing la « 
owitrolted by a conventional programmable processor 
66 whloh, for simplicity, la not ahown con nested to, for 
example, the keyboard «0 orlhe card Inpul device 61, 
or totfiD verifier 82, ortha olher modules employed In 
the machine. Tha means to aocompllsri this would be » 
obvious to one> of average eklll In tha art, tha alanine 
copier would alee possess « conventional scanner eo 
that It would be oapaWe of dlgtltelng tha Informalion 
present on tha document Indicated at block 69. It could 
«ttheaamatlma,<ipltonB]ly,encryptatblookerih»doo' w 
umont content* II could aleo have present at 60 a da* 
viae whloh heaps traak of the currant data end lima of 
' day whloh liytormelloncan be retrieved and wad when- 
ever desired. 

■[0036J Tiie filgntnfl mnOhTna 2R llluatratad In Flfl. 3 Is so 
oapabla or carrying out both safe of functions Indicated 
In Ffg.2 Inwhlch Itcan produce not only the elgneddoc. 
umaitf 36 but also tha digitally cleaned document 40 
whteh haa been auihanlloaled. Thua some of the mod- 
ule* Moated In Plfl. awouldohlybauaedaltheaandlng sa 
and whan (he original dooumentls hard ooplad. whereaa 
olharmoduttawcutd be uaadattharaoelvlng end where 
Iho digitally oleaneiland authenticated hard copy of tha 

■ signed dooumantle produced, Alternatively, two differ- . 
ant machines oould ba provided, one Just for oreallng <» 
efgncd dooumenle at theeemltng end, and lhe other al 
(lie receiving and for verifying tha authenticity of a 
stoned doaumenland protfu'olng a digitally otaanad doo- 
umant. 

lOWri CotitEnulrm With the deaMlpflan, atblook 62 «ie « 
reauHantdigiial signature oan ub generated by pfouesB- 

vlng with any known algorithm with the eeoretetgnl ng toy 
of the ueer to generate a dlgllal signature whlolt can to> 
affiled to the optical copy that haa been made of the 
original dooumant. Trtle mercer of tha optical oopy with « 

. tha digital signature oootira at block $4, In addition, fur- 
ther information could ba Included in the digital signa- 
ture, e.g., a time etamp which would Indicate tha date 
and the time when the algned document was produoad, 
[ODSBl At tha raoalving end, tho deoumant 39 placed «> 
on tha maohtna would bathe signed daoument, and In 
thle oasa the (Unotlon of tha maohlne would ba to make 
euro that tha digital algnatura that appeared on tha 



3/Bt a 

algrted dooumant la valid', lb do ihle, aa previously da- 
sodbBdjha copying machine muat obtain a valid copy 
of tha atgnefa public cheohlng key. 
[0039] Affarthe digital slflnaluras hava baen oheoked 
at Wook fl6 will determine tha next ataga In the prooeBS- 
Ing. There area numbarofposBlttllHiBB here, Forexam- 
pie, If the dlflllal elgnatuw la notvaild, (hen Ilia maohlnB 
la raadHy proBrammed not to copy II, and to dteplay on 
tha maohlne a message aayrng thatthe hard cop/ orig- 
inally presented 1o the machine has not bean authenti- 
cated. 

(0 WOJ On the olher hand, where the dlgllal elgnalure 
ohadlia, and tha original supplier was authorized, then 
tha maohlne oould display 6 message 93 Indicating that 
a hard copy prodaoad bytha maphlna la Identical (a one 
that wtt* praaented tea almllar machine at a OBrtalnttma 
and date, For Instance, the message oould read "Thta 
dotumarit (meaning iheouiputted dkjllelly oleaned oopy 
40) wee submitted for oopylng by John Doe on May 0, 
1601 at 1166:35 p.m, Whan It was submitted. It looked 
Ilka the herewith aupplted oopy." Attematlvely, the mos- 
aaga can be put on the etooument Iteelf. A* a further al- 
ternative, both forms of Informing the third petty user of 
tho authenticity of the hard copy of the dooumant can 
be employed. 

(0041) Thus, in the oyatam of the Invention, any user 
document oan ba supplied to tha maohlne for authenti- 
cation. The signed dooumant oontenteoan have digital 
Information encoded In II either In visible or Invisible 
form, Marty users of such machines would ba available 
whose authority la readily eatabllshad by being tasued 
a card whloh Is «uth«itll0Bied by the machine supplier. 
WWIa a smart oard la a preferred way of Inpullfng lha 
elgner'saeorotelgnlnrf key. lr> principle, the keyboard 60 
can also be employed to oa»ry outtho Beme funollon by 
maansof known paeeworolaohemes . It wo ul* be possi- 
ble though not essential for tha signing copier machine 
manufaoturer to lasua and authantlcate the smart cards 
oftheueera.Atthereealvl/tgand.theeigneddofiumente 
would ba entered for verification and the algnlng copier 
would recover the digital Informalton enocded In the 
(ionumcnt arid verity the euppller or creator. 
[0D42J SurnmarlElngtha preferred embodiment, adlg- 
lie) algnalureeyelemnnay bethought of aetwofuncllona; 

(I) slgnalure = 8lt5N(d00ument, slgnMflKeyOrA), 
and 

(II) valid ■ CHECKtdoGument, signature, oheoWng- 
Key WA), where; 

"daoumonV 1 means any sequence of bits; 
"elgnlnflKeyOfA 1 ' meana aeorat Infoimallon 
known by A whloh nllowa A (and nobody elee) 
to generate valid elgrtalura&i 
signature" la aeequema of bits generated by 
the signing algorithm, with the number of bite 
ranging from a few hundred toe Few thousand, 
depending on the Bpacliloayatem end tha epe- 
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o]fto astorlly level Involved In the application, 
at well 99 various porformanoe tradeoffs; 
"ohwltlneKeyQfA" Is malhemattoally relatei to 
th» etsiVngKoyOCAii where user A would gener- 
ate bolh lha signing hay ant) llie orwoktofl key, « 
and theslanlna i»y would ba kepi secret, while 
the oheoMng key would be made public! 

KHJ43J The 'Valid"' flag fa a elmpfo boolean, elllier 
TRUE 0/ FALSB. IF ilw signature for a fltven dooumem « 
was eensraled by slgnlngKeyOfA, (hen Iho CHECK 
futuffion wi return TRUE, Indloallng that everything I* 
OK. If the signature or dooument hae been altered In 
any way, Itien lha CHECK funotlon will rolurn FALSE, 
Indicating lhal the signature la not valid. » 
[0044] Tfia foilowlna scenario i»'iiiusrraUv« of how 
auoh appllwulons could work and represents an alflo- 
rllhm dssorfolnrj a preferred form oflhe overall perform- 
attoeotlheayafam! ^ 

4) The cuBtonwr prepares a document, auoh as a 
signed contract, and approaches the signing Cop* 
tor, 

■ 3) the ouetomerlnserla their "dTgnlna oard" into the 
mplei, and places the original on lha fltess. The *a 
copter djpjiftea and compresses the image, eigne 
iheoompreseBd Image, and store? lha signed oom- 
praseed digital imageina user Inconspicuous fash, 
[on on the resulting "copy 11 (aolually a "signed orig- 
inal"). ■ « 

3) farther hard ooples oan now be made «) the 
efgned original, and «a long aelUa Image quality Is 
not too degraded by repeated copying; iho original 
digits! Informfilton oan be recovered from the oopy 
sndverlllad.- as 

4) The epBolal signing copier maotilnoB woutd re- 
cover lha digital Infoimatlon, restore iho quality of 
ttiBdooument, and verity lha authenticity of the doo- 
ument. other oonvanUenal ftoplere could simply 
copy tha document *> 
a) Tha'"fll(nied l> nature of tha document could be 
Indloated by using special Ink or spools! hnreMo>du- 
plioate pftKerrta. In thlBfaaWon, Ihefaotthalthedeo- 
umantwae ajgnad would be readllyappawtoii vis- 
ual Inspection. Thephyeloal nalureof this uasr-ob- « 
vJoub Indloator doee not affeot tha logical design of 
lha system. 

a)Th^swnBiloflBBumea thata reasonable keyau- 
thentloatton protocol la use* by Me copter. In ps> 
tlouiar, l! wflumoB that the "algntng oarde!' hsund to m 
customer* oan be appropriately authenticated by a> 
suitable entity, euoh aa the signing oopter menuffto- 
lurerw supplier. ThB'simpiaat itielhodof doing this 
woutij be to Issue such 'Waning oardtf'dlreotiy from 
the machine- supplier, ohtirflfng some modest prtoa, «e 
ThB customer would have to present documents- 
(ton adequate to pB/euada the supplier that 1hay 
were Indeed who ihey claimed to be, after which 



(hey would be Issued a slating oard. Tha signing 
fiords Issued by the supplier oould tie readily Wen* 
lilted by any supplier's copier as authentic, but it 
would bB impossible for any non-supplier agency 
(leglllmate or otherwise) to Isauo a signing dart) that 
any supplier's copier would thlrtk was auihentio. 
7) Tha recipient of a signet) oopy ooutd easily verify 
' that It was authantlo by plaolno It In any Signing 
Copier, which would verify the awureoy of lha doc- . 
umont. 

B) Optionally, If doslred, 1ha atgnad tnfommtlort 
oould dewlfea vm* phyehral aBpaot of in© plsoo 
of paper on whtohlt appeared. Inlht* way, it would 
be Impossible to make authenticated duplloates. 
Known way* doing this have baen based on the 
pnUam Of libera In the paper 6» a physically unique 
Miller for that particular plans ol paper. In this 
sowtarto the aeent that deals with the ouBtomer 
might be thought of eia a "notary ptinllo" who hap- 
pens to be employed by tha supplier, Tha elgnlng 
card Issued to tha customer owi be "tamper proof, 
■ " eo that the ouslemer Is unable to aooess lie con- 
tsnfs. The algnlng oard may have an on-board ml- 
snproaeaeor end memory which Implement the 
nsoBsaaiy algorithms. The paaeesslon by the ous- 
tomer of the stgnlno oard Is evldenne that iho cus- 
tomerts who they olalm to be Furiherauthentloatlon 
mlaht be required, e.g., Ihs ouatomer might also 
have to know a password, or the ouetomefe flnger- 
priVrtmlghi be enooded In ths signing sard and var- 
Wedbylhe ooptsr. the elgnlng coplereuthantloatss 
the elsnlne oard, and might perform further aulhen- 
llaallort as nsedad (e.g., ask for a password or 
oheWtlhe tinsernrlnte). The oopler would then b» 
prepared to leeusd doouments that had been digit- 
«lly'slgned by the oUBlbmsr. From a technical point 
of view, ohanglng any bit at all In either lr>* doou- 
ment or the signature will invalidate the signature, 
If asjngte pixel l&out of plana in the image, Iho sig- 
nature will be invalid, to pranlloe , thli means acme 
former errorr»rreollnaoodewlll«tmoatoerta|nly be 
required if the digital Information la etorad an paper. 
Paper oan have dirt, grease, coffee, eto. spilled on 
. It, and unless IhB error oorraollng oode t* quit ro* 
bust, (hlB would Invalidate the etgnaluro. 

tOMtlJ For mor* InformeiHon on digitaiaignaturas and 
mesne for Implamenllng earns, refarenoe l» made also 
to Matyae "Digital 6tgnaturea -An Overview". Computer 
Networks 3(1870) pp, 67-94, particularly Sect. 9; and 
Upton el at "Making The digital Signature Legat-And 
safeguarded", DatA oommunloatlona, February 1078, 
pp. 41-D2, espeslally pp. 44, 47. 
(0046] While the Invention has been described and Il- 
lustrated In connexion with preferred embodiments, 
many variation* ami modlfloallonB w will be evident to 
those skilled In this art may bemads the'relnwllhoutde- 
parttno from the Invehlton, end the Invenltonae sat forth 



In the nppemted-olalma Is thus not to be limited to the 
praolso (fetalis of construction set forth above ae «uch 
varWIormndmitdlfiDaltorie are Intended lo be Included 
wKhln the 8 Wps of the appended olejms. 



1, ApTOoe»fOf«iak!nflanauthfiftlloatab]fthaHJoopy 
du P Uo0t${as)cf an original <Jpqumsnf<20)supp]I^ 
by ran enlHy, ownpriaTne! 

copying the ooniante of said original riooument 
(20) on eatd hard copy (3B), and 

Incorporating en eald hard copy (36) a digital 
slHMture (38) representing sett* contents and 
the Identity of eatd entity. 



A process for 
hard copy dupKoate {3B)made of an original docu- 
ment (SO) supplied by an entity and oomprjslng the 
content* of eald original do6umenl(ao)antf a digital 
signature (33) representing eatd .contents ana the 
Idently of «a!d entity, said preasse comprising: 

oh soklng aald digital signature (36)cneafd hard 
copy duplicate (98), and 



Indlottlfng whether eald haid copy 
(35) Is aulhsntlo. 

», Aproom «t claimed In claims, further comprising: 
If eald hard copy duplloato (8B) Is authentic, copying 
' aaW.eonlenta but not eald digital elgnafura (89) on 
at least one otherhawi copy (40). 

4, A process ae olptmstf In claims 1 to 9, wherein: 
eald digital slgnalure (30) Is generated using dual* 
hey authenttaallon with « secret signing key repre- 
senting eold entity* 

«, A proseee as otatmed In elalm 4, wherelm 

eald a.ulhenlloata,t>l» hard am duplloate (3B) fur- 
titer oor/iprltjos a putollo hey lhat Is malhomatloally 
related to eatd sacral signing itey. 

e. A unit for making an (tuthenttoatable hard copy du- 
plicate (86) of an original dooummit (20) supplied 
by art entity, comprising: B * ' 

meansfwraoetvlngsatd original dooument(20) 
from said «n1Hy, 

means (64) for copying the mniante of aald W 
original documented), 

means (60,61) for wwtvttg Information 



uniquely Identifying aald anflly, 

means (62) for verifying said Information, 

meft«s(B0,62)for8enerallnsadlgltale!anatura 
(36)repr»sentlnos9ldoon1anf8andtheltt9ntlty 
of aald entity, and 

means (64) tor producing eatd hardcopy dupli- 
cate (3B> oompftolng eald contents and said 
digital signature (36). 

7. A unit <u> olalmsd In claim e, whereim 

eald rneans(92)forgcneta1Ing aalddlgllal signature 
■ (39) uses duet-key authentication with « eewet 
etanlruj key representing eald entity. 

ft. A unit as olalmsd fn claim 7 k further oomprlslnj; 
weans for Incorporating a puWIo key that Is mathe- 
matically related to eald secret alanine key on said 
hard copy duplicate (36). 

©. A unit for authenticating en authentfostable hard 
copy duplicate (68) made of en original document 
(20) supplied by an entity and comprising the oon- 
tenleof eald orlglnaldocument(2(>) tinda d/gHalale- 
natu»Oe)repreBenlln0satd contents andfhditlen' 
tlty of eald entity, eald wilUomprlslng: 

1 mean* for rsoaSving said hard copy duplicate 

(&«,and 

means (fi8.eB)foriihsoktng eald digital efgna- 
lure(36). 

10. A unit as otalmed in olalm'O, further ooniprlnftig: 
means (OB) for tndloattng whalher said hard copy 
. duplloato{3«) Is authentic 

> 11, A unit ne olaSmed tn oMm 9 or 10, further oomprli- 
(ng: 

msans'ror copying said contents but notsatd digital 
etgnature (86) on at least cna other hard copy (40), 
It said aulhonlloateble hard copy duplicate (3ft) te 
» authentic, 



Patenlanspruotie 

1, Verfahren jaim Erwugsn etnas autharitillzlerbartni . 
HaHkbptsdupllkete (96) e|nss Orlglnaldokumenla 
(20), das durah elns Enlltat bewllgesfollt wlrd, wo- 
bsl dae Verfshren folgsnde SahrHLe umfMrfi 

Koplawn dee tnhetlfe dee Ortglnalifokumsnts 
(20) auf die Hartkople (35). und 

EintUgan elner dlgllalen Sirjnalur (33) tuif dor 



15 EPOC 

Harttople (36), wobfll die dlgilalaBiflnaUii? (30) 
dsn Dohumsnilnhall eowie (tie tderillttU der 
Bnllltliwlederolbt, ' 

% Verfahran ium AultiBnlHteleren sines authantKIzler 4 - 
toaren Harlkop [9dup1lktit« (39), (fan aim efriem Orl- 
glnftldoHumant (20) er/attftt wlrd, da* duwli elne 
EnllM bettllgestelU wfrd, und den tnhaltdes O/Jfll- 
netdoKuntenls (ZO)*owle efnedlflltala 0(gna.Uir(a6) 
■■umfasBt, walohe dan Dotomsntlnhfllt awle dl« 
WflftlKaldaffiniliaiwIederfllbt.wobBldnaVo/f^ren 
folaandeSohrlUs iimfasst: 

Prufen derdlglittlen 8lanatwr(3&) aurde'm Hart- 
Koplatfypllkat <3&), ynd 

Angeben, ot» <l«a HartKoplsctuplM (35) an* 
thsntla'chM 

3. Varfiahren naoh Anepruoh 2, Welches waliertitn um- 
fasst: 

wenn dm HartfcepledupSlkat (3B) aulhentlaoh 
MKgpfaran daa In hal!e\ abernloht tier dlgltalen 81- 
gnafur (36) ouf wsnlftetena elna airfare. Hartkopla 
(40). 

4, FVtaflBs naoh wanlgslens efnem dor AnepiUclia 1 
bls3,wobe( 

die dfgllsh* aigmiur (36) untar vtwwendunfl 
elnsr Zwef-SohlUfiflal-AuthentllfilefuiiQ mil slnem 
Behelmen 8!gnlBraohHisi»| erasuflt wlrd, weloriar 
die Enfllfltwladarglbt, 

«. Vsrfa1irflrinaotiAnBpruoh4iWBb9ti 

das egthanlKWetbara HaHk<iplerduj9M(S6) 
vffelterhlh allien CHentllohen eahlOsBel vmlmU dec 
mathamatisoh nuf den gehetrtien StflntaraotilUaasI 
bszoflen 1st, 

6. Elnhell swm Briwugen eliaa authsntlltafeibaiien 
HartkopledupllkBl* (35) eina» Orlfltneldohtimenl» 
(80), das duroh sins Bntllitt bsraRgestallt vm, m- 
beldlaeintieltumraaat: 

sins Elnrtontunnaum Empfangendaa Original- 
doftumenta (20) von der Brrtltttl, 

alris Elr»r!c)ituri0((34> zum Koplaren das Inhalts 
das Oflfllneldohumenlfl (20). 

elna Elml&hlung (60, 61) aim Emprangan von 
fnformslloti, waJDhe dls Idanlltflt ejndaullg 
tdenflffelerf, 

eineeinrtohUmg (OP) wm VWflstforen der Infor- 
mation, 

elneElnrtohlung (SB, 62) sum Erceugen elnsr 



dlgllaJen Slgnalwr (60), welche der» tiokument- 
lntadl und dls Idsntlttlt dsr Entliat wletferglbt, 
und 

o elna Efnrtohtuhg (94) zum fiKeugen das Hart- 

koptodupllkato (3B), das dan DoXumenlfnhaH 
' und dl» digitals Stenaiur (30) umfewt, • 

7. ElnhaltnaoltAnBprunh6 ( wafc*l: 
'» dleeinflohlung(02)zumEffeuaenderdl9ilB- 
lan8lgnaliir(3S)eln»2wal-8tih[U99Ql'Avitnanimzts- 
rung mlt «Iti am geh8lmsnSlgnter«ohl(tBB9l verwen* 
dst, wlolior die BnlHM wledeffllbt, 

« 3, BlnhaltnaonAn9pTuoh7,welQtiewallsrtilnumrtlBeti ' 
elns BInrlohtuno aim Hnfttgen olnae Monti!- 
onen-SohlUiBelB, der malhamailBoh auf deji getisl- 
msn dlgnlarsDnlllBBs) bazogen lat, auf dam Hartko- 
pladupllka1{36). 

so 

9. EHUieit gtum Aitlhenllflzlarati etnea aulhanllltelatba- 
rsn HartKopledupllKata (30), da&auB etnem duroh 
etna anllttthareligaetalltan Origmaldohumsnt (30) 
sfzsugt wJpdtHMl d«rt lnhalt des OrtBliwIdokMmenw 
«« (20) ewJla sing dlgllala flfgnatur (38) unnfesst, vial- 
. ohadon Dokumenllnheiltund dte IdBntlietderBntltat 
wlederglbtj wobaldia Klnhalt utnfaael: 

sine gltirlohlurtg zum Empfangen daa Hartko- 
p]gdupllkata(65} r Lmd 

elne Etttrtohtung (6S, 60) zum PfUfen der dig)- 
talBn Slgnalur (36), 

ss iO, llnholtfiaohAnspmohO.welohawalterblnumraael; 

eftie Hnrlghtuno (SB) zum Anesbsn, obda& 
Harthopladuplllta (3C)aulhonll8of> 1st, 

11. Eltihelt »aoh Atispmoh 0 *flsr 1 o, walsh* welterhi i 
4? umfassl: 

etnt ElitHshluna turn Koplaren dsa Doku- 
montlnhalte, aber ntoht der dlgHtilen Slgnatur (36) 
auf WonlgstaiB etna andera Harlktfpte (40), warm 
daa aulhentlffzlerbare Harlrlop1edupllkRt'(3B) an- 
4S (hBnllaohlut, 



RsvsndloattoDft 

t& i. Praoede destine A rsallseruno duplloatlcn da coplo 
psrmanerite autnentlffabla (36) d'un document drt- 
glnal (20) fountl par una anllta, oampranant : 

fa copla du oonlanu dJdlt document original 
of (20) eur ladlte ooplspermanente (36), 6t 

Wnoorporat!oneur1adit9oop!9permanent6(a5) 
d'dns alflnafuw numarlqua (30) Kpraaentant 
[edit oontenu at IVdentlle da ladlte ontlls, 
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2. PrecedS deBllriA A. euttiwitlflor una duplication da 
oople permanent* auihentlNable $9) fait* a psrtir 
6'«n doniiirtant origlnet (aO)fiuml par una entltAet 
Qomprenflntlaconfanududltdooumantqrlslnal^O) 
at una signature numdrlque (36) reprtsentant fedlt 
oontenct of t'WeniSt* d» tndKe onM, iBdlt preeede 
oomprentmli 

|« iwnlrote do larflta signature numsrique (36) 
aur tadltB duplication da oople parmtmente 
(W),et 

Undloatlwt dw fall que ladlte duplloalton d« co- 
ple permamente (9ft) esteulhentlqua 

& ProoetIA salen la revendloalton 2, oompranani en 
outre: 

$] ladlte duplication dBoaplspBrmElnerite (39) 
«s( aulhantlquA, la copte ctudlt oontanii'mafo non 
paa deffldlts elpalu/o numMqita (36) aurau itiolna 
une auire copte parmanente (40). 

4, Prooede sewn (as revendlaallona 1 ft 3, daria 
(equal : 

ladllo algnaUire nutwfti'lque (38) W genera* 
en utlllaant una aulhentlftcatlon A' tfoiAla ola aveo 
una old ^signature eeorete raprdaehtantlqdlte w 



B. Pm«#da salon la revandlcallon 4, dene lequel i 

ladlte duplication da copl* permanenta 
aWhentlflabl* (SB) oomprend en oulr* una o]A pu- 
bllque qui e»t maMmatlquBment Uee a Indite ol* 
dftetgnaiureeeoiite. • 

a, UnftA desllrtee a rtaHaer tine, duplication da oople 
pormanente authehlltlabla {36) dim dptmmani ori- 
ginal (20) fournl par une entile, comprenant: 

git moyen dwtine a neoevolrlftdit document* ri» 

filial (20) .da ladlte onllle, 

unmoyen(54)de8t!nS ifloplwleeonlanu dudlt 

document ordinal (20), 

«i> moyen (aft* 81) destine a reoavotr dee fetor- 

mtrtlww Idantlflant do feflon unique ladlto on«. 

tft, 

un moyen (62) destine averlllor laedltea Infor- 
maltarta, 

' unmoyan^.ezjdaBllrtaaeenflfafunaalflhh" 
ture humeitqua (39) reprABantantledlt oontenu 
StlldenlltedatadlleenllUfcflt 
ut> moyen (84) destine A produfre ladlte dupll- 
oalton da cople parmanente (36} ctfiipwnsnt 
ladJI contemi ot ladllo signature numArlque 

7> Unite salon la revaridloHtlon 8, dana tequelle : 

ladlt moyen (62) deallnA a gMrer ladlte si- 
gnature numerltiiie (3d) ullllso una authenllUaatton 



A double old awo. una old deatgnalure eacrAte ret- 
prtaentantfadlleenlita. 

e. unit* sfllon la iwendioaltort 7, oompwant en 
outre: ' 

nit moyen dsBtlnft a Irtoorporaruna da publl- 
que qui eat malhemat^uamanljlea a Indite ale de 
elgnfttoe eeorete aur Mile (tgpltoaflon de copte 
permenento (35), 

0. Unite destine* A authfitillfter una duptloatton de oo- 
pie permanent* aalhentlftoble (36) falte A parilrd'un 
document original (£0) found par una entite at com- 
prenant la contanu dudlt doaumetif oripBl (SO) el 
una signature, ttumerhiua (36) representant ledii 
oontenu et I'ManlHe da ladlte entltt, tadlla unite 
oornprenant : 

urt moyen destine e. raaevolrtedlle duplloailon 

de oople permansnte IfiV), «t 

un moyen (66, 68) destine A oontrfilBr ladlte el- 

gnaturonurn9rlnuB(3&). 

10. Unrte Baton la ceyanditatlon 0, oompiwant en 
outre; 

un moyen (99) daslln* A Indlquer si tadHe d u> 
plloallon d»doplapertnanente<$&) 6b1 aulhBntlqua. 

11, unite salon la revendleallon 0ou 10» comprenant 
enoulre: • 

un moyen d»llln* A copier ladit-oonlenu mala 
non pas ladlte algii&twe numeifquB (30) eur au 
molna vne autre cople permanent (AV), el.lsdltv 
dupnnatlondeoople|ierfflanent«authahllflable(36) 
eatauthentlque. 
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• Won loB<»0flr»b8(ltettlhLt«l In lht> nutwoik without «hnr. 
BacreUrtformalltBt ol mm (a pnwfdad 
The system Hhs b single mttBW authartetton 
oanter ar«ng«t'lntho hBtwork, Ihe master aulnsiidoa- 
llon oenter eharlnfl wllh Iho usar a war eaorat key. and 
a plurality of slave auHianllHitlori oentere staring wllh 
m master «utti»ntlbflttonfl«nlMr8flpfloMvftse<irrtl<*y8 
different from tho war aiorst toy. Tha master authanft- 
oailori (enter flulhantlBate* the user by ustofl tho uw 



eeorat key and Issues a cerlH!«ts* frttornfiallon wJiloh 
oailHlaa laaltlmallonoMhfrwar, tolhe uaar If lha uaai la 
MrihanttoRtMl ** a Kfilllmata user. The atava authenti- 
cation earner autharrtloiMee the cwMIpaIs Inforrrmllon 
from (ha user mk* Issuae a permission Infoimalton 
tthlahri! W*nl» aooattto tupBBWled ww*r or anappll' 
oaltfirt eerrar In lha networfc to lha user If lha user la 
aUhnrrtloaied as a Inanimate user. ' 
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Description 
Twhnlon.lPlolfl 

The prwtt lnv«n11on relates to (in autfientJoallorj 
cyeicm for (cfenUtytng a by rteWotfi when foe ueer 
Intends to eat nBtworksorvkm 



In order to confirm (hat ft user wht> requests net- 
work B^rvloflBor communfMflone (hereinafter oslled bb 
b network user) la r legitimate user, It Is naotttory cd 
Bl4'(iBlwoiK8ltlftto«ulhenil««to1h!flUBor. 
. A prwer Is in general IdantHled MDh that; 

<t) Information poeeaaaedflnly bythe proven 
(2) Ik Identrilod by a verifier by meane at a certain 
method, 

where the prover la a person being atithenlloated and 
the verifier te a pereonauthentlofttlng, 
' Th« Information pusssseed only by the prover (1) 
can b» utaBBHted to the tallowing two information of; 

(1-1) Information arHflofally provided (password, 
Identllloalton number, eaerelkay, «lo), and 
' (14) foforrrmflOrt baaed upon Individual attribute 
(holograph, fingerprint, votoeprtot, rstrna pattern, 



Authentloalton depending on the information baaed 
upon Individual attribute exoept for the holograph 
Is now not appropriate for use In an authentication 
device via a network booauattaf Itsfaw reoapllveoapao 
Ity Inecolety, It* poorootwenlenae, Its poof IdetttHtoaHon 
ratio and « Wflh manufacturing cost of 1h& authanttcft- 
tlon apparatus. Therefore, In rooef ossob, the tntorrtfift- 
tlon arfflkMy provided {M> euoh w password, esowt 
number or secret toy are used at (he Information pee- 
eeasedonlybytriepiover; 

The Information wUrtalslty provided (fnfotmatiori 
Inherent In user) wri bo olaseliled, depending upon Ita 
storing to Ihetoiiowlng thr«» methode of; 

(1-M) storing InfMitifillon In mind of the uaur 
(password, Identification number, «to}. 
' (M*) storing Information In a etarauepoBeeaeed 
by tha ueor (tor general key magnellooard, 10 card, 
etc), and 

Blorina Information by combination of <1-1- 
1) and (1*1 -t) (cash dispenser provided In a bank 
• lng organ, eto). 

Since tfie above fllaeaSflonlton Is performed from a 
etendpolntot tin authtttfloallon system, aoaea wherein 
the user tatas a note of his password or Idsntlftaatlon 
number to his memorandum wlllfee otaaettletf to (M • l>. 



fn a computer network, tha above-mentioned 
malhod of etoflnn irrtormallonln mlndof theuaer 0*1*1) 
le maMy iriM However, aooordrng to Mb storing 
method (M-i), irnpemontitlon oan be relatively easily 

e porformMt by daoodlng or stealing the password or 
Identyfoatton number ant) also, lit moat eases, this 
Impereonallon will not be found out by the parson him- 
eell until hO piMIOfill/ suffer damage, This la because 
the eeoret InlormMlort According to 1h!e method (1-M) 

w Itself may bs dfraolly revealed, and thus isakefle, deal- 
ing or wiretap of the password or of (he IdanUffoetlon 
numbarwUlftaettallyauooeodett without oDnwiousneM 
oftheueer, 

Contrary to thta, according to tha method of Blaring 
ib information m a etemgaiposeejBadby the ueer (1-1 -a), 
elno* the user can found out lot* or eteallng of hte pob- 
aeaeedatofatio end thus powlbTo damsoe oan be fore- 
toiown, tfiedHmBflfKian be prevantedframooourflna by 
pBrformlrta an Adeqvate profledur* emttlhitthe lose or 
to etealfnj. The Btorlng method (M-a) oomblnedbyti-i- 
1) and will be errentrVe eo ae to prevent Illegality 
ev*n» the poseeeeed eloreflola stolen. OF mm, how- 
war, ihadamaflB will not be prevented from ooourrlnji If 
the etoroge le forged without oonsotaueneee of the net- 
«r wo)k and the user. Therefore it ladeslred to ub« a »!or- 
aga wtitch te dlfftoull to forge. Per thla aim, an 10 card 
wlthOPUfJterefnaftBr oalttfttMrwuftoajd) whiohwill 
keep hlgft aonildentlftlfty is the optimum, 

Tha method of Identifying by Ihe verifier (8) can t>» 
so subaiaiillHlIy otaaalfled, dapendlno) upon what Wnd ol 
Information does the ptmr prwenl to ihe vernier fnet- 
work), to the following two methods of, 

' (2-1) preaantlng ueef e tnherenl Information ae It Is* 
w and 

(i'2) prasenttng a oatouWlon result ol the user's 
Inherent Information. 

However, the method of preeemity) tieei^e inherent 
4a Information (2*1) haa dlaadvantage ot easily revealing 
hie seoret inhwant Informatlort. In wflloulw, « fth 
, meihodis oombtned wHh the aforementioned method of 
storing Infof m»|lon in mind of user (i -1-1), there may be 
extremely dangeroue for revealing' the seoret Inherenl 
« InrormationtopubUo. The method of preaentlrig a calcu- 
lation result ol the users inherent informntlon may 
be olavallled In «ooordano& with Wnde ol this oalouta- 
tlon. 

Anyway, ihBpresent invention rataloe K> an authsn* 
so tloalton meihod of eharlng eesrei user's inherent infor- 
mation betwsertft pwvar (user) ww» a verier (networh), 
«norypt!ns and tietryptma the hform&Hon at the user 
and the network, reepaoliveiy, and then cheaHns ldontl> 
floatlon of the decrypted Irrformalion with the shared 
tt iniormaltonaoaetoverifytheueer, 

It should b» noted that It la dlftlou.lt to combine ihe 
mathod of preaenUnQ « ceitoulaUon reautl of the 11801% 
Inherent Information r>a> with the auihertitoaUon 
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method using tho information bfltod upon Individual or an application server In the network, (o the user II the 

attribute (1-8). user la aulhanlloatedaea^pmale user. 

Aft la dettribad abovo, Die BamWnaHon of the. filer- A» will feoflpparontfrornthei above (ttsorlptloit, only 

109 method (1'M) with lhe> method 6) prosenitofl uasr's one Waaler (uithsnlltmlton center possessee the user 

Inherent Information (2-1) la ttorrtoBtdanflarouB, and * eeor«th«ydctherUini»th»r4»{>eol!vetiBe)«, and mere, 

the oomblnatton of the storing method (1 >l-3) with ttie too eaoh of the user sewetkeys |» not shared by ft nlu. 

method «f presenting a oaloulalton mult of the user's rallty ol utere, Furthermore, alnoe the muter 

•Inherarrt InformaKon (2-9) to ine safeet, An auitiewioft- .atrtherrtlodtlon oentor ejiihintieatea the user by using 

tloneystsm using this latter combined method with 1Mb usar neural k«y and Ibsuqb a trarlrltoato Intormalfon 

smart cards Is now reaped In 6 part of nubile oommu- « whioh oerflf las lepitlmatlon ot lite user and me Blaze 

nlcalion network* emih a* GSM (Global System for «irth6nlfoatlOJio«ri(«f nvttiwltofitM the cerlHteale- infer- 

Mobile OflirimunlOtttloriB). (nation from tha user and fau.ee a permJMlon Worma- 

However, ficcoKMns tothosyelew using lh« method (fori whleit allows an access to a specified server or an 

of presenting a calculation result of itis mar* inherent application eerver Fn ths network, «ulhent!oa|!on toad 

Informattoftta-a^elncelhfttJeDtypitonofliciJlaiiDnhHB m «mb» distributed, 

tobeperforniedftteverywihenUoatlonpWMa^losti*! Tne ajwMUon server can exeoirlo the roioo! the 

tho aulitenllDfltlon prooene will be owwanlretod to an BbOwmenllQniid Bleva euihenltoallMt oenler. In Ihte 

aulhenlloatlon dsvloe In the network, which manages oaeo, the pocmldftlen Informally and etao the elave 

mm Information- <A were, aulhentloatlon osnier can be omitted. 

In order to "avoid euch problem, load ol the oRtouta. w It !i preferred that the system adopts an authentic*- 

liana tor aulnenttoatlon can be cflefrlbutad Ina plureilily tloneohemeriDton1yforverllvlr)0nM»erfromeinetwark, 

of autriBiiUoatteri devices by p/ovtdJnjj the eeoret Infor- ty enarlriB; the wm eeoret k«y feetwesrt the M$er and 

rn'atlonorua«r«t!>tham,K<iwever J cil&perelriOtrieBaoret the network, encrypting a known Information uelnglhe 

tnformatlonof usera lotha plurality of the aulhentloallcn eapret hay «i tho user to produoa tin! emsypled Infer- 

devlnBBwfllreBiiHriotonlytoweretlaftletyofauthBritlM' w Nation, tomsmWrirj the flrrt«n<ywt«drnfw«ift1)Dn from 

tlart butafeo extremely Inarmed ooiifor managing and the user to the network, eiwypllrta the Known fnfoima- 

for operating Iheaaorei Information In eat ». lion using the eeoret hey at ihe networkto produoa sea- 
ond encrypted Inrormallrw, and ooflallng IhBffansmlftod 

Disclosure of Invention flret enorypled Information wHh the produced eeutrnd 
so enorypled Information at the network, butaleo tor vsrify- 

It Is Ihtreroro an objeot of the present I nvenlton to !ng the network from the user, by enorypilna a known 

provide an authonttoalTon system whareby aulhenllo* InfoVrtiatlon valnn the saoret m *1 th» networkto pro- 

(ton fond can be (Muled In the network wllhoiitehar* dues tfclrd encrypted Information^ tranamlHInti the third 

Ing eeoret Information of ueere when <aoh of ihe uaere enorypted Intarrriallon Irom Iho network to the uaer, 

la verified. ** enoryplliifl the loiw/n Information uslnrj the ewfet key 

■ Acowdfnfl to the present inyantlon, an ftulhentloa- ut the ueertoprotiuoe fourth eitorypted Inloimatlon, wid 

ilon eyaiemadoptlnc) en awlhentlwtlonaeheme for vert- collating: the tranamltted thlfd enorypted Information 

fylnj a mt from fa network, by eharlno the eame Beoret With the piodwsed fowih Bnor ypted rnlarrnatlon at the 

key between the veer ami the network^ enuiypVnQ a mi Thle mutual atithantloAtton can topw* aeouriiy 

known rnfoimRtlon velnrj the eeoret key at the ueer to «r attd aerlalrity of aulhenttoatlon. 

produofttlfflt enorypledlnformatlon, tranernlttlnoihailrel H la ahjo preterretf lhai the ueer htse an IC card pre 

ertoryplBd rnformatlQn from the ueer to the network, vfd^l with * OPLI (BtnttTl oand), «nci that (tie emart oarei 

enorypilna the known InTormallon using the eeoret key tixaoutee manaeement of ttie user eeoret key 4nd 

• trf the network to produoa aeoqttd encrypted Informa* enorypHon and decryption of the Informallon. By u«ltid 
Hon, and collating the irwBffiltttfi flrel enorypted Irrfor- is auoh a ehiart oaid for niarm&lnrj « uier BBorai kay and 

' matlon with the pwtuowl twsontf enoiypted Information lor erwryptlna Informalkirt, the eeoret k«y will not reveal 

at ths'tidtwork, la provided. The eyetem tia,a 6 single to & oltsnt terminal and therefore forjjery thereof will 

master aufhtinloatlon center arrangod fn the network, bMoma quite dlHloult resulting to ketp Mgher security 

the maBWraUlhBiillciallonofihlerBhsrlrtflWllhth4usor« of aulhentloftllon. 

user.eeoret k&y, and ft pltrolliy 61 eteve bulhehllcallon eo Pwforeibly, the eeoret key used for enarypilng the 

oenlwe attarlng with the matter authentication oenter knownlnformatlonlBakeyuelngarantfomnumtteraert- 

r*«petillveeMf»ll«yed1ffer«nlfromtho«eer««or«|kw eratet) at the user. Encryption using lhlel»y with ft ran- 

ThemHdt«rAUthen1toatlartoenterautrientloat4»theiiBer ' dom number willprovKfes more highly security, 
by using Ihe ueer eeoret key and Issues a oerttflMte 

Information whloh earlHIss leoitlrtiatloh ol the user, to » Brief Dewnptlon of bmv/Mfls 

• m uwr IMhouser la fluth?mioBted«ea Iseitimateuser. 

The elave awlhttillofttfooi eenter wrthenlloatsB (hooertlf- Rs» 1 la a blank diagram echematloally Bhowftig « 

leate (formation frcmiheusar and leeuee a permission oonelilultan of an embodiment {jM emt>odlmenO of 
Information whlohallowean acoosfl to a epsoHled server 
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(inamhenlloftUoK^yslamnoMKlfnBto.ttiopreasitt dseoribed (star and poBsewad by «aon 11 

tnvanllnn:' denotes a card rwuier/wnar tor muting InTormattort 

Pki 2 la a ekaich uVtematfiiaily ehowlng throe *w» « wrtttft Information to the mm oawl 1ft en« is 

nhaaa sMuonoe of aulhanltflfltlon mom» In tho donolsea olieni ternifriHl coroieofctl to ihB taMtaMer 

F?aTaeiLE «"» tomi. wmum- ™» mmm U will bo 

Ff B .4teft»!<6tohehflwIng<let(tllpftCfitiureln*a«e- The emart card WlaoonaWaW^ 

t»lfl,fl[s««!«rtoh*howinfld6!ttllpfoaKiiir»fftft«ilKl » a<»6artl/olfore)«in^iB«bouiiBKeandaCPUoftor 

aulhsnlloMnphMO shewn tn Flg.Bi «mmpte8bNe. ThB ollenttermhial 12 to.c<m*tl(!rtedOy a 

mmtton of «n another embodiment (aawnd wHalcowutorandoonne^ 

*mhodimsnli of «m aulhenttoWion eyeiem aooord< for exampta LAN via a oDmmunlwllori Ifna. Tna otisnt 



^mhodimsnO of <m aulhentoW on ey*iem aooorti< »r example im wa a Qommunireiiori «n» j™ « 

FlS, 7i»«irt«Mi ahowrnfldeiall prnttom hinlku i» <md rt» a terminal tow Wing riNtNMM 

Pliae* of an aKflttffllft cl wrthairltoatton pwatuw In fcontan ft]»1loaHon eervwetda. Wlhoughonlyone oHant 

IneambedlmBmehown In Fta,6i terminal 12 le Illustrated to Fig. 1, li»to(rtfteramBybaa 

' Re.aii>«i«K«Uh«ho»r n |»<|aTaLI praeedurolna no* plurality of eljent twHImri* having the aM » co* 

ami phaae o) th B example ol tho authentlfiallcn ft> tton «e the terminal 1* «nH wfiMGWd Via reepMtlve 

BroDWBB»tnthaeKibodlmwt8Vi6wrHiiFlg.e: oommuntoationiinee. f 

Fig, 9te ehowlng detaK procure ln« im Aarngtt r^WMlhenfoaU on ^«^"^fg 

phase of an ahother example of auihentiflafion 1* provided Wllh auttwnllwiflon program whloh will fee 

proo&asflBlnlhe embodiment shown In Flo. ft ■ desartbed later, a/plurality otolava eAMMfen oom- 

Pig, 10 le a etwloh ohowltia detail prooeduro m a « ore (elave AuO») Iftp^ed Wllh wOimHwllon pro- 

second am of the- «noiher oxnmoie of the gram whloh will b» tfeBOTlbKl later, and at tenet one 

•aulhantKmllon prooaBsaBlnlheambodlivientshcwJi apclloatlort server (APS) 18 provided wllh twinr Bide 

In Flo ft end appllofltton and aulhenllaatton kernel ara anniented lo 

«B.iit8ftflk«toh«hwin0«»ntwtof«OBrtHloftilort the«etoork19«o«tobo^to«m«iun!o»tewlthtiie 

SfihownifiFlfl.fl. lnada»abaHBl4apiovrtl«iforlhemaBteraulhan«- 

imemsnow «.» Miicnoemef 1-1, Mlewl of tear data toohaeusera 

BBBtModfcfarCaTfytnaOmihftinymtlon aoerrtkw^mloo.biB^llttofMOBBraantiaTRw 

' AuOdataBUs*jit8eftBfalkw*oHhareBpaolW4«tevo 

Rstewlna to drflwInaB, embodiments ancaidlna lo as arthanltoalloii oanlam 1 8 aro olorod, In a tWataBtt 1 Sa 

lhopreaimtlnv*ntlonwlllbodas«ilb«irtidetiill. prsvloWtollnihviMfflw^ 

v of AP8 dala ellch aft ftaorot f»y{a) ol tt» appllafttlon 

PiMEmbMilmant • aetv«*(B) 16 are etored. Tho mafltar aulhfltilloaton 

Flo, t ta « Wotii diagram eohomsfloally Bhowlrta a «> appltoation Bsrwr 1ft m «mm*d by ganmi pur- 

' constlMIW of an embodiment of an aulbBntlwlIwi *y«- p6W «otk .bMIIbw. t raBpaDltvaljt OommunlBalioTO 

ttmaoootdlnotothaBWBonllriVBnilort, betwean «n» (jenerat purpoaa work aiattofts and 

mathbd of praeenilnfl 1no oflloulwion result of mm orrtpurpow pwmiim oonnputararo carded outftroufih 

Itihmnt tntormalloii (8^) and also the already mwi- « RPO<RamotaPfODedurflOaH}. 

tlpned wethod of eltirlnfltho uaece inhercnttnfomraSon Th« mamory In tKo smart oard 10 etares a sewat 

Ina smart (1-1^. Aooording to tne preaominvan- key fntwrontlft a emarl o^tdholclar (war eetret k»y KW. 

thin, bmm t"«» maihod of etorlnathoueert Informn- ThoOPU lnthoBmwt6ard1(H*proa«m6deofl 5 tocal- 

tlon in mlndJ of tha u»er (1-1-1) or too 8toitno*n*lted (1- . tttlateft oryploaraphto runotlon f with thlseeoret hay Ku. 

1-B> of wmbtotilton of *nd (1-1«) way be ult- « TT>0 tietwortt 19 has (ho only one mnur wftan I. 

iiKteflBteaByandv^ilr^iitorevaaithaeBorat option oflnier 14. «nct the* usm o*or*t key Jfti Ib holtl only 

Ititoimaitoniopfliformtho oalouiatlon ottho method (a< by ttilamaatar auttientloalton oenteH4, Boihthteein^e 

2) by the user himself. Ttow, iWa oalaulallon should be martBr flwlhsntloatlon cwUr 14 and the . alave eu lienll- 

dor» by a poiaaHlon ol the, user, having both olorlno wiron center* iStoAother haw mm^ wwrt in of- 

andoaloutatlonfunDitone, auohae aemart«fl«(.lit»!Bad « mafloit Inharent fn tho nepaoVn slava ^hnAntton 

of tho ww himself. In Ihie oae«, tha above-mentioned . oentero 18 (stave Auo eeorat kayo Kal, Ket, m,...). 

Sn methods (1-1-2) a«td (t -1-8) are uead. At»o, both the applloallon eefi/oie 16 for provrdlna nal- 

li> Flfl. *, rataronoe mmaral 10 denoiea a Brnart wofk aarwloes totha ueareantt the elavo authentloatlon 

oard provided with proawm «nd file which will be cenlere Ifttoeethar have secret Intormailon Inharent In 



every applloatlon nmn ie (APS secret k«yo KM, 
Kaft Katw). 

Aulhentloallon prosflSWB In lhl» embodiment wilt 
new ba described, In tho flowing proowsw. suppos » 
thau user f mentis (o anjoy b daeiroei network ««rvioe 
from asnsolllo application server it 

Ftort, the user Insane hit pos Msaing smart <wrd 1 0 
Into IhB readerrwrlter 1 1 end then wmm the client 
terminal 1fi nafollowo m m lo wtlwrte the smart card 

Pot m oard uaer, a PIN (Personal ttMtMrflon 
" Numbar) oode ha* bsen previously defined, end this 
defined PIN cod»hMb*enalc<ed!nih6smart tmrd 10. 
Theuesrlnputehto PJM eodelhrouglilheetlsrH termlrial 
IS Into the smart card 10 eo lhat cotooktonoa between 
• km InputPINoodaartd oneetowd In the emBitoard 10 
Ib attacked. This onetKof Iht PIN o«i« la exuutfld by 
interna,! ope/fltlonof ih&flmMcard 10, II PIMoade Input 
Is wwawlvely failed three times, no more assessor 
uaer oipcailliy Is possible, Slnue the memory In the- 
smart card 10 la a nonvolatile, atoKme,.the number ol 
thapasl eu<K>BBBlv& PIN Input failure will be hetd*wri If 
the power Is ofl. 

Afterihe smart card w ro eotlvaUd by local verifies.- 
iron between the user an* ttiB wiart card 10, aulhenil- 



lion phases, each prooedura will be dasoribsd fit detail. 
Symbol* Illustrated lii thftsatlgurw Intftoat* as follows, 

AuO (Wlhonflcaiion writer 

s m Intiorert number assorted to a 

amort card (held by iho smart oard 
dnttthft master AwC only) . 
Ku usar secret k»y(h«Itf by thfremart 

oard and too master AuO only] 
io Kb etava AuO aso/at key (shared by the 

master AuO «nd each of (he slave 
AuOBOillV) 

Ka APS secret key (chared by elava 

AuO oriel each of the APSs only) 
« Ku-€ senret key bstwaen Ihe email oard 

Etnd the slave AuO (disposable key 
generated by muter AuO at «very 
Imubiio* of liter Certificate) 

Ku-a sacral key bitwaen the smart oard 

so and the AP8 (disposable key gener- 

ated by slAVO AuO «t Mivfssusno* 
ot««rvlc» UtlllMKon Uflanaa) 

o^ddr network addraaB of the ett«nt torml- 



eaquenoe schematically shown In P[». ft. 

A first phase Is' © request arid Issuance of a us«r 
o Wtlltoale. In this flrsl phase, the user side (smart card 
10) requests the maetsr Au0 14 to Issue a oojlHloatlon < 
Information (user psrtrMte) weed for exwullngwilhen. 
lloaflan pfooadure vi(th (he slave AuO 1ft The Issued 
UBWCWMoato which fiaea valid period tn stored In the 
smart oard 10. Prior to' accessing the master Au0 14, 
«t* user side (smart oard 1 o or client terminal ifc) oo r> < 
firms the vattdliy of the already obtained ueer oertHicate. 
A« long «» the ueer osrlHioate Is valid, the fiuthsnlloa- 
tton processes can ba Jumped to a, next seoomt phaee 
without aowsfllno Ihe maeler AuO 1*. This oauaei 
Ihrouflhpul In the master Au0 1 4 todsorsae*. 

Hie sewnd phase li 0 request wid (HBuence of a 
service ullllHitlon llotrtae. tn this osoond phMB, the 
ussr aids (smart oard 10) requasia, with tndtoatlno the 
, uB«ro»rl1float*, the slave Au0 10 to laauB a pervasion 
Information (esrvloo utllteatlon Home) tor ulillilng the ■ 
sppUoaUah served 10. The slave AuO 15 will verify th« 
Uesr OeilltlDalton praaemed by the amort oard 1 u, end 
Issuathe esrvtco uilldallon permission If varHled. 

A Ihlrd phase la <$ requeit ftnd onjoymant Dl a net- 
work servfee. In this third phase, the user slda (smart 
oard 1o) reqUBste, with Inttloaitno the eervlos yWlwlltin 
llooriw, the flpnlloBflon aaivar « to provide a desired 
nthvorkflsrulM Thaeppiioaiion «erv»r 16 will verity the 
irtdloatsd wrvloe ulllliftlton llosma And provide the 
requested eervlos to th» ollent terminal 12 If th» Ihitt- 
oa(edlloanaets.vflr[fi«l. 

Rererrlno to ftp- % 4 and 6 whtoh show detail pro- 
cedure In the above-mMllonsd rotparifrs aulhsnltoa* 



I 



f(dala,K) 
f 1 (tla!R,K) 



or eypiriftBifWOot valid period) . 
UBer osTlHIofitft (iBsuad by the mas- 
ter AuO and dwypted only by the 
clave AuO) 

service uilllzallon.lloenas (Issued by 
IheslavoAuO and decrypted only by 
MAPS) 



each other 
propose or comirmtrio colnatdenoe 
of time stamps Xand Vwllhln apre- 
dstarm!n«l'msretn 
prooas««f enoryptttTfldala with lay 
K 

process of tfsoryptlng or Inversely 
ermrypVnadatawHhK 



Pig. 0 Illustrates proueduro In the first phaBe 3) (or 
requesting end lasting « urn carttae. As ehown In 
thlB figure, tit (list, (lie ollent terminal Ik gen«rat»9 « 
time stamp Tei indicating the ourrontllma, The gener- 
ated time stamp Te1 and a network address ojaddr of 
(his oltoiittermlnal 1ft are (renamlHed to the smart oard 
io. m rig, a, thla irermmiBslori Ib rapreoertted by 
[TeljO^atWri. these transmitted data are concatenated 
' with each other In the smart oard 10, and then ihB con- 
catenated ctata la sWypted by using « user secret key 
Ku previously 4iW4d h the emart oard 10 to obtain 
AwI(Tei|o ftddr,Ku}. then, an Inherent osrd mimbBr [Dti 
etoreol In this srnafloard 10 Is fead outatid tranemltted 
to the master Au0 14 with the encrypted A bs for an 
aulhejttlOBttort rwaieai. Thtft transmission ts repre- 
sented by [IDif.A] in Ra. a.. The oard number idlt t» 
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transmitted without enoiyptlun. Although all oommunl- 
csitone botvveBji the smart card 10 and the master AuO 
14 are exeoiM through the client terminal lathis cli- 
ent terminal iaiteelfoiMiWl analyse the encrypted dm 

Th» waster AuO 14 generfllss a time stamp Tee 
trmiMtlii()(illmeofr$(i(ilvlnBtrie6ulh«Htloatioti request 
from the client terminal 1a, Then, a ussr etorei hey m 
te Inquired from the recslved oatd number fDu using ilia 
database- 14s, Than, the encrypted A Is decrypted by 
means of a timoiion TtijojiddM- '(A^i) with iha 
Inquired user eeprel key Kg to obtain thBllme stamp Tel 
«MheollBiit igrrfllnfll 12 artel the nefiwikaddreas a addr. 
Golnatdanoe betwatn the obtained time stamp Tel and 
the tlmft stamp Tee generated at the master Au0 14 1» 
thm verified, Gmoe Tea Is necessarily delayed from 
Te1 , ihls cflllaUon of oolnotdenoe line to be considered 
with s marclti of ilma delay of fan exarwto ton eaooKde. 
if thetiserseorstkey Kuused (n enorypilonai tha smart 
eard eld* to produoB A Is fnoonreot key, the decrypted 
Tet will extremel/ differ fram TsfcThuBjfthedsorypied 
Tel doBo notsoinclde wlthTbfcwIllt consideration otthe 
margin, failure el 1h» fluihsntfofttloji is Wormed to the 
ussr side and the process Is terminated. 

IfthedflorjipledTBloolfioldBawIlhleiwItheoilBld- 
oration of the margin, following procedure for Issuing a 
user cerllfluMe will be executed, Flret, at the master 
AUC 14, h eeerel key between theemart oard 10 and the 
slave- AuO is Ku-e la generated and then an original 
user cerUKcMs Oari(Ku-s,Tu l oji(ldr) ocnelellng ot Ku- 
e, TW and ojaddr. This user oemttoate Cert le 
enorypled wins a stave AuO secret hey Ke which le 
shared only by the muster AuO and lis slay* auo, to 
produce* Osrt'. Namely, by using « oryptoaraphto fume- 
■tloh f, Cert* Is obtained tram 0eri\.f{08Jt,Ku). 

Thereafter, Rsa is generated by trweraely ettorypt- 
ma Osrt' as well «« Tefi and KU-s using the user saoret 
key Ku, namely from nee^oert , |Tta|KiM! ( Kii). The 
generated Res Is then returned tothesmnrt cam} 10 as 
a response message wHh raspeot to the mm from 
the user ({fits]). Because of lower calculation cspaolr/, 
It l» desired thai tho smart bard 10 executes only oatou- 
lellon based upon encryption fu notion 1, Thus, at the 
master AuO 14, Inverse onoryplkm f' 1 Is executed 
Instead tfenorypHcrtl. 

When the smart card to receives tha response 
message) Rse, Ihereoslired fteBlsdeoadedbyth*Umo> 
tlori f using (he user eeeret key Kir, namely from 
Cert'JT82|lfu-a.f[Res l Ku) f to extract and store into the 
memory Irtthe smart card 101he encrypted user corn- 
eals Cert\ the tlms stamp Tea and the secret key Ku-e, 
The ertraetedtlmeeiamftTsB tatransmSltsd tcHhe client 
Wmlnat 12 and thereto veiHlet), with respecHo oolrtsf- 
dance, with the lime stamp Tel which wastfsnerated at 
thlatemilnal ia(Tet»TeB?J. T*me,lh6 master Au0 14 la 
vsrttled by the smart card 10 resulting thai the smart 
card 10 and the master Au0 14. are mutually authenti- 
cated eaoh other. Aooordtng to.the above-mentioned 
mechanism, thee eoret Key between the smart oard find 
the slave AuO Ku>a Is used tor coiJimunloslton between 
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the smart card 10 and the slave Avi0 16 without being 
revealed outtide the smart oard 10. since Cart is 
encrypted tistogihe slave AuO eecretfcey Ks, tha smart 
card 10 and the silent tef minffl 12 cannot analyse it at 

6 «H. 

At a next airihsntloallort pioosdwre, prior to floosss- 
ing tha master AU0 14, the client terwlnai 12 read out 
the time elamp Tsa stored in the smart sard 10 and 
compares El with the current time to Oorrllrm the validity 

to of the storsd user certlllwte oerr. As long as the user 
carrWcate la valid, the suitientlcalton proosssss can be 
lumped thsltrst phase shown In fig, % to the next eso> 
ortd phase wlthniiiHOoesfllnglhoMstsr Au0 14 caus- 
ing throuehput In tha master Au0 14 todemreaae, 

» Fig. 4 Illustrates pronedure Irilhe second phase © 
for rectusstlng and Issuing a service vlllbiaUon llasrtse. 
As shown In this 1laur», at tfret, the eiisnt terminal 12 
generates a time stamp TsS Indicating the aurrent time. 
The generated time etamp TsBartda network address 

to ojddr of this ollsnt terminal 12 are IrantmMad to the 
smart oard 10. fn ttg, 4, this iransmistlsn is repre- 
sented by [Te&ojitfdr]. If this second phase ts exe- 
outed fust after the f/ret phase, ae Tea le equal to Te1 
wlin oonsirferatlono'fthew&rtfn ando^ddrhasarready 

m been sent, this process oan b» omittsd, These transmit- 
tsd date are concatenated with each other m the smart 
oard 10, and then the concatenated data, is enswisd 
By using the secret key Ku« whloti was transmitted from 
the master AuO 14 vm the user oor!Hloatt» Cerl 1 and 

go stored In the smart card 10, to obtain 
AWf(T«3jojKWr,KU*).Thsn t 1hs«BBroerilllsatSOeil'le 
transmitted to the slave AuO 10 with ih» ensryptsd A'. 
This tranemlsslon Is r epreserrtect by [Oert\A] In Pig. 4. 
Although all communtoaltona betwesi the smart sard 

ss 10 and the Slave AuC16 are also exacted through the 
. dlent terminal IB, this Dllent termlnat 13 Has!! oannot 
analyze ths enorypled data, 

The slave AUG 14 generates a time stamp Ts4tndl- 
cailngatlme 01 reDslvmotheaoosssfmmthesllent^ 

40 mlnet 12. Then, the enorypled user sartHloats Oert' is 
dsorypted by mm or a funonon Oertef'VCerr.Ke) 
using the elave AuO secret key Kb stored In the slave 
AuO »5 to obtain a deoryptsd Osrt, fn Ihls dacrypted 
user os rtHloate Oert, the t!m» clamp Tea rndisatlng the 

49 iMuanoetlmsof this user caitllioaie Osrt, the esoretkey 
Ku-8 and thenetwomaddrsssof theeHenUBrmlnal 1a 
<Uddr«w moluded. lYm thsobtalned lime etamp Tea 
Is checked by the time stamp Tja4 to conlfrm that the 
UBer oerW loate Oert weeiesusd at a time wllhin a prede* 

so lermlnsd period frornnDw.Tf)UB,valldllyorthls user car* 
llfla&te Cert Is confirmed. 

Then, the encrypted A' Is decrypted by mesne of a 
function TsBlojaddrsxt 1 (A'.KU-s) with the secret hey Ku- 
eoontslned In the mt «eirjfloat» Cert to obtain thatlms 

eo alamp T»3 of the oileffl terminal 12 end the network 
address ojsddr. 

Ooinoidencebetwesn tha obtained iimeetampTsS 
arid the ttmesiamp. rs4 generatedattfie slave AuC 18. 
and colnoldenoe bstwean o^dttr oantalned In the u aer 
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QflitillOBie Certandeaddrconiaincd in A'arethertverl. wno»teri&tedwiih eath other In the cmartoard 10, and 

f led, If the ueer cerlitMt* Cert Ib forced one. alnoe the then the concatenated 'data Is encrypted by u»lno the 

secret key Ku-sand lha network address ojKfdr con- . eeorei h«y Kki-a which was transmitted from the elave 
latoed In (hie Ctrl flannel be fractal end also tha ■ Auc 16 wlih .the esivio* uilHzaiicm (loons* Llo* anil, 

decryption ustoo this key KU-aoannot be executed, tha & Blared In the' smart oard 10, to obtain 

collallon will be failed. Thus, In (hie case, the stave AuO AMTaaiojaddr.Kw-a). Than, the service tteetie* LW Is 

15 will not l06U&«wrvio&iit!ii*fltionllo9n«Bl.to and tail' transmitted to th» application' eewer is with the 

ur«<rtlhQBUthanUaallonlB[nliaTmBdtolh»u»»rsldata arwypled A". Th!» transmission Is represented by 

terminate Uio prooesfc tM A'l in flrj. 9. AWnuflh all commwHlOWEona between 

H the eellailon euooaeoe, toliowtna procedure for ** the smart card 10 emtltht applfoaltoti oower iSfirftfllon 

iMitlnaaseruloftutllfiiBtlDnilnBnesUevrillbeexeoulotl. exeoutadihroiiBH^ftoIJonHermlnal IB, infoollenHerml- 

NM, *l the elev* AuO 1B, a aesrat fey between Iho nd 1fcl1»elf oantiotanalyM the worypted data, 

smart oard 10 and A epeoHEa application server 18 Ku-a tha apptaauor? server 18 eeneralaa a lime stamp 

is generated and than an oriojnai sarvioft utilization Tee indioatino a trm* of waiving the asaem* from tha 

license UctKfra.Ts^addr) oonnletlna of Kli-a, Tae w client terminal 18. then, the encrypted service utllfea- 

and ojtMr. Thla service license Uo la encrypted uefita Von license Ue" la decrypted by means «f a fwnoiion 

an APS secret key Ka which Is shared only by the clave U<n>t\L\t?W u«>nfl the APS eeoret key Ka slorBd in 

AuOflndlhaspeattktappjloallon server, toproduGs Liu'. the application server Id to obtatn a daoryptad Uo, In 

Namely, by uaTno a oryotofliaphtQ function f. Uo* to tola decrypted ear We wlllwrtlon license Uo, tha time 

obtained from UaV(Uo,Ka). This encrypted eartrfoe w stamp Te4 Intftortino tha iBBAiance tfma of itilft lloeiwe 

ItoenBe Uifoanhaanalyttdcrtlyby lha epaoHIo applica- Llo, the «oret key Ku-a and tha network address of ihs 

tfon server hRvfoo. the eaorol key Ka, client terminal 12 ojaddr are tnotudad Then, the 

Tha roaHer, Res' Is Generated by tnvareaty en crypt- obtatnad tlma stamp Tb* la enacted by tha tlitia fttamp 

Irtjj W ae-wetl aaT«4 and Ku>a ttafno (heeeoret key Ku« Tat) to «mt Irm that the lloenSB Uo was loaned at a tin™ 

a, namely from fleB'-f <(|.l»'|TeJl|Ku a,KU'S}> Tha naner- as wHMrt a predetermined period from now. thus, validity 

ated fw le men ratuvned to tha emart card 10 aa a of thtslloansa klola confirmed, 

rewonte rneg«ag»vdtl« reipspttolhe mm framtne Then, tha enoryptad A" la deorypiad by means of a 

Lnter((Aee!|), ttinDltonTe6{ojida>«f >1 (A H l Ku-a)w]lhtheeB<)rfltk4yKu- 

Whan the emart CBfd 10 raoetves the reaponaa « oontalnad tn tha lloensa Uo to obtain tha time stamp 

message Res', the rasBlued Res' la deoodsd by tha so TsJS of tha client tsrmlnal 1& and tha ttahvork address 

tiinotlon f vmv the searet key Ku-s, (tamery from ojaddr, 

Ua'|Te4]KU-tU;f(Raa > ,KiJ'S) l to axiratt andalora into the Oolncldanoa between the obtained Uma stamp tbB 

memory (n lha emar I card 10 the encrypted gervfaa uti- and Ilia lima slamp Ted gtnaraMd at the application 

IkBlIon linens* uo', tha time stamp T«4 and tha aaorat - . aatver le, and coinotdenoo batmen o^addr ooniainad 

key Ku-a, The extraoted Urns stamp Te4 te (tanamlrted se In the license Lte and o atfdr omtaJned In A" are then 

to the ollenl termlnsl 12 and therein verHled, with verllled, II the earvloa' utlldfllton license Uo Is forQsd 

reBpaot to oolnotdotico, with lha time stamp TeS which one, elrtse tha MOfet k»y Kit-a and the nBtwmfc addrees 

w«b generated at thts terminal 12 (T$3*Ta47). Thus. o^ddroontalned InthlBlloenaa Uecannotbaextraoted 

the slave Au0 15 la veitiiad by tha email card no result- and also tha decryption using thle key Ku-a cannot be 

Ing thai the smart card 10 and the slave AuO 18 are 40 axeouted, tha eolation will be failed. Thue, In this case, 

mutually authenitaated each, other Awordfns to the lha appllcanoH eetver ie will riot provide a network 

ftbove-metiloneti meohanlsm, tha aecret key bewtfln service and Mura at the authentication le Informed to 

tha emart qard and tha application server Ku-a la used the user atdefo terminate tha proww. 

for oommuntcatlon bslwstn tha smart oard 10 and tha f th» oollattoji euooaede, at tha appHoallon eervar 

application server 10 wtlktoul batna revealed autatda tha «s 10, Res? la generated by Inversely enorypHnff Tee uefne 

e'mart «ard 10. Since Uc* le enorypted italic the secret the secret key Ku-a, nemely from Ra9"»f' 1 (Ta6,KU-a). 

key Kb, the smart card 1 0 and th a client terminal 12 Tha Generated Rsa" (a then ralurtted to tha smart card 

ognnot analyze it at all, 10 as a re«ponaa rnmafla wllh respaot to lha aooasB 

Pt(t, 8 iltgstrataaprooedura Intho third pfta*a'<3> for from the user MRee'l). 

VaaueatlnBantlenJoylnrja network aervloa As strewn in eo When the smart oafd 10 reoetvas the reepwea 

thla fiflure, at first, the silent terminal 18 generates a mctcasa ftes", the received Res" Is decoded by ths 

time BtflmpTBSIndloatlnfl the ourrari time, The oener- funollork t ue!n0 tha secret k«y Ku a, namely torn 

ated Urns stamp TsUanda network mm ajxttr or Tw-fCflsa ^KU-a), to extrcct and atcra' into th» memory 

thla«llantlB?mtna1 1K aralranimlltadto the smart card rnthesmartoard tottioenoiypted time siampTao. The 

10. in Fla> S, thla iranamtssion in represented by m eMraMedtlmaelampTaOlatmnBmlttatitolhaollsmter' 

ITa&VLaddi], If thlslhlrd pliaao Is exeoytftd Juatanar th& mlnal 1ft and therein verified, wllrt mpM\ to colnol- 

ssoandphaae, asTsB leeqiiaHpTsS wltheoneEderatlon denoo,wllh lhatlma stamp T*6 which was genoratedat 

ot ths margin and ojaddr has already besn sent, this this iarmlnsl '12 (TsB-Tse?). Thus, tha appitoatlon 

prooBse can be omitted, These transmitted data are server 16 Is vefflbd by the emnri card 10 resulllno that 



tit* srrwt oard 10 and Hie «ppl[Cflllo» eervar 16 era 
mutually authenticated eaoh other, n lha mutual «ulh«n< 
itoatinn fl'jweBdBj ihe apptaon esrver pfovidaa the 
n»Jwwh*ervfoa toWi» dlant terminal 12, 

The fttovementloned ctulhenlipalton procedure is 
nweaaar/foftlitte eynohronliallon between the master 
AuO M. 1)10 slave AuO 18, the application server 18 and 
the client terminal 1ft. TMti lit baoausa ftllmelnlorma- 
tlon (time stamp) Is ueed foi an authentication data 
(data for cryptaptphto function) known by both iha 
prover and lhr> verifier. Instead otthetlmerntornraHon, « 
randomnu^eroBrtBmtftdslihBV^fllls^netwoikBWB) 
end transmitted io the user aide *en 'ton uUllwd fie art 
authentication data, Hke<icriBl!ano,e.reBppnsB autlieniv 
cation protocol used rn GSM. A second embodiment 
accordlne, to Iha preeonl invention, which will be 
described Is!* r, usee title protocol, 

In the aforementioned llret embodiment, iho infor- 
mm to be'transmltied from the smart card io le 
encrypted directly unity 1h« user secret key Kw, the 
« taveAuO secret hey Kb or the APS secret key Ke. How- 
ever, If A key Is produced by entuypllng « random 
nunrtwrHcsneraledatthesmarteard lOuslnglhe uBer 
eegret key Kb, the elave AuO secret hey Kb orthe APS 
secret key Kaandiheinforirmilon to betfensmHted from 
the smart card 10 la encrypted using we produced 
enoiypted key, hither security can be expeolad. In this 
cm, the random mmtfMr R hwto alio be transmitted 
ta the master AtiC 14. Iha slave AuO Ml arm appltaa* 
lion server 18, 

Furthermore, although In tha aforementioned 
erwbodlmeni, individual slave AuO keye Ke areprovitied 
rtvther^sgllve slave AuOMslnrjIe slave AUG key Ke 
can be shared by ell tha slave AuOe. in Ihe latter caB#, 
however, security will be eomevrtist lowered. 

fian orjcj gwirtodfirwiit 

p|0. e l» a block diagram eohemaHoaliy showlno a 
constitution of an another embwMmenlol en euHitjntlca- 
1|onayetam«coordlnp;1o the present Invention. 

In theflfture, reference numeral nmertww e, smart 
card provided with program end file whtoft wll be 
described tnlar and possessed by eaah user, 11 
denote* a card readBrAwller for reading Information 
f«mgrwf[tlnulhfoKrtiat!or»fothaamartoBrd 10, orxt 1a 
denote a diem terminal eomteoied to the reader/writer 
11, provMedwIlh cilentddeapplloellonandaplhenrM- 
tlon kernel, respectively. The reader/writer 11 will be 
mounted fntldeorouteideol tha client terminal 12. 

The emurtoard 10 Inthleambodlmenl leconetlltrted 
by an lO.oard with er1thm*tl*funo«Oil ( which consists ol 
« memory having a capacity of for example equal to or 
lose than 0 HB end a CPU ol for example 8 bite, As hav- 
Inrj a slmptor nortsMort of this embodiment than that 
of ihe llret emtwitmBr* tha smart oard 10 in ink 
embodiment has 1h& smaller capacity memory. The cli- 
ent terminal 12 ta oonslliuted by efieneral purple work 
eteltort or ft general purpose personal oamputer end 
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oonneoted to a network 13 euoti aefor exert^le LAN via 
o 'communtoatlort line. Thle client terminal 18 l» an 
access point of fits wer to the network 13 and also a 
terminal for providing network service from an applies 
s Hon aw m elde, Allhougb only one client lard r»l lit l» 
illustrated lit Rip. 6, mfftot1rieremaylwapluraiiryo»ell. 
em terminate having the similar oontlltullcn as the ter- 
minal 1S and oonneotedl via respeelive communluallon 
Ifnee, 

w An aulhenllcalldrt oenler (AuO) 17 provided with 
ftuthentloatton prorjram for verityltifj the user and at 
least one opplleailon server CAPS) 16 provided wilh 
eerver side appilrotlpnfdrprovtdlno eervlaee totite user 
m oonneoted to the network 13 eo to b» able Io 

io ttinimuntaRtewUhthettlentterttilnsl iRvlattilenetwoik 

13. 

Irt a database 17a provided for tha authenllofitlon 
oenler 17, the least of user data auoh ai uierte secret 
keys, system Icrj, b!aok lie) ol lite unre and 1 eeoret 

to k«y(s) of the application eerver(e) 16 are etared. The 
Aulhsntlflatlon oenter 17 and the application server 16 
are conetuuted by oenerai purpoee work itallon*, 
reepeoihttf!/ oommunloanone between the rjsneral pur- 
pose workstations and between fhefleneral purpose 

it work station and the genarai purpose pereonal oompu- 
ter ere earned out throuflb ttpc (Ftsnwte P rooedure 
Call). 

Hie memory In the smart owd 10 stores « eeoret 
Hey Inherent In a smart cardholtterftiiir saoretkey Ku). 
so TneOPUln theennatoardioisproflramed eo astecev 
culateaisyptographrofunirttorifwithlhleeetrelKeyKu. 

Ire ihe netwofk 13, Hie M»«r werel key w» Is haid 
onlybythe Airthentlcnllon otnltr17. 

Both 1Mb aulhanttaalion center 17 and (he spplfoa- 
ai ttan servers 16toflBlher tiave reepeetlVB eeoret Informa- 
tion inherent In the retpRaUve application server* 16 
(AP8 eeoret keye Ka1 , m, «*&,..}. 

AulhenttoaUan prooeaees In this embodiment will 
now be described. In ihe following proaeseee/euupose 
49 ihat a user intend* to enjoy e desired network eervtoe 
from a epeorHo eppHoallon eerver 16, 

First, the user Inserts We puseeselrirj emart oard 10 
Into the reatferAvrlter 1 1 and then acoetees the client 
terminal 1a ae follows eo ae to aoMte the emart oard 

K 10. 

For Ihe oard user, a PIN code tmebeen previous)/ 
defined, and We dellrred PIN eode has been etored In 
theemarloard id, Tha ussrlhpulehts PIMcodsihrauah 
the client terminal Ifl into theemart card loeolhat coin- 

bo oldenoe between iha Input PIN code and one stored in 
the smart oard 10 Io oheoked. This check of the PIN 
code Ib executed by internal operation of the emart oard 
10. If PIN node Inpul lefiuMesslroty felled three limes, 
Ihe emart oard 10 permits no mora aooese and th'ue the 

us fitrthwiloaltoriproeetfuretermlnatee. einoetfia memory 
irtlheemartoaHdiofeanonvolailieeforaoe, the number 
cfthepaet successive PIN Input Murawlllba halt) even 
If Ihe power Is oil, Ttils etoratje will hs cleared It PIN 
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cod* check le succeeded wllfiln successive three times coincides with Retf, However, ft the ueer secret key Ku 

Itipule. Ib Incorrect, tha calculated results Ree and RW will not 

After the emartcafd 10 la aoiivatedhy focal veiltloa- wtoclflV with won other, in thfe case, failure of the 

Hon between mo ueer and lha> smart card 10. autharttl- aitlhentlrjAlfon Is f jitormsdto the uaer Bide and theproo- 

oalloti wmm are oarflad out with following two e ejefatermlnaM 

phase eequenoe. . If the mi^pM (W wln&Wee with Rett, a user 

A llret phase la request and lasuwioa of a uaer w- certfHeate Oertandan authentication Information Autnfo 

Moate. I'd thleflret ph»», the ueer side (emartaard 10) ere Issued for too imttftoard 10, Ceniemeof the leaned 

requests ItieAuO 17 to [s*ue a oertHtoRlton Information uaar osrtrlltiale Out and authantioAtlon Information 

(u«»r oertiftote) whloh verHlee him The towed tiaer » Aulnfoara Indlnated in Fig. 1 1 ee an example, 

aartlitoale whion has a vsKd period la stored in thesmart lit order lo prevent frcmtraudutsnt, (He uaer ceritft- 

oard 1 Q. Pdor to aonaestng the AuO 17. the user etde oats Oert la encrypted using ail AP8 Marat k«y Ka 

(emarlca.rd 10 or cllerrt terminal lajconllMne the validity whloh tssharedonly bythe AuO 17«mdlhe APS lOoor- 

ol the already obtained uaer certificate. A* tons as the responding tu the application aervertiama APS NAME, 

user certificate Is valid, the authentication proGsasss re to promos Owl, rJamel^byuBlnsttoryptcflraphtefunu- 

eaiibaJwiripadtoftriftxteecomtpliaaavrflliDulatwaas' tton t Oerf It obtained from Oert'*i(oeift,Ka). Trie 

•■ lnfliheAuOl7.TtilBoauaaaibjoirghputiritii4AuOl7to *uthentloat!o»» informallon AulNfo and the enwypted 

' decrease, user aarMIeate Oerf an trantmltted to the amort card 

The second pftaee la request and enjoyment of a 10 and stored therein. Slmio the enoiypted uiftroertHI" 

itetwoikeervtoe. In thlepftase, the uaer etde (email card to cale Oerf cannot be anatyzed at fta. user elda, necaa- 

10) request*, with indtcaUng 1h» uaer <w (Meat*, itte *ary Items euoh as an e^lilno time are transmitted In 

application server 16 toprovlde a deaJred naWoWceew duplicate, 

lea, The eppttoallnn server 16 will verily the indicated Allhougn th» tlret pheee in a challange-rMpiMBe 

ueer certificate, and provide ths requested aervloeto the aulherrllcnllon scheme has bean described In detail, an 

client tormina! 1 i II lha Trtdfo fttod cerilllwrta is veffilo* *» authentication system aoocfdliip; fa ihe present liwen- 

Plflft, 7 and Bshuw an ejiampta of detail oraoatfuw Hon oanbaaQhleved bya mutual authBrtttoaltort aohawa 

frt the aUove'mwtlon«l reapeotlve- ^utrientloatton wherelnlnevsereTdaandihenebvarlfeldeaulhennDate 

phases, Plaa, 0 and -fa chow an another example of eaoh other, 

detail procedure wherelna mutual-aulhanllBatlon math- Hg, e Htuatnatea prooeduw In (he (fret ph&ee In the 

ttnlem la adonied, Oomlttnatlen nt pioDedure of Ptg. 7 tt mtfuaUuthBrrtlottlcn meonanism, As ahowrt In this 110* 

and that of Pfcj, 10, And combJrtftUoii of prmedure ol Fig. lire, at ttral, art Itihwem card numbar IDu stored fn this 

9 and that of FIJ, 8 «art be poaelble. smart card 1 0 la read out and transmitted tottie Au0 1 7 

Plrj. 7 llluslratet procedure in the Hist pliaea lor wtth« nama of the application eervar APS HAM6 which 

requaftMrtfj ami leeulng auser carlWoato. Ah shown fn will provide a daalrednB^oihefirtlceea an ftulhanllas- 

this flflvire, at Href, art Intierent card numhar ItJu slored $s Hon requeai thla franemtaetoii la repreaMod toy 

In thla smart card 10 Isread DutandlraMmlttad to the ttito,AP& MAM6J In FI/j. & 

AUD 17 with (t name of the application server AP8 TheAuOiTnanamteaararKlomnttmberRntilancl 

NAME whfch will provld* a desired network aer^oa «s tranamita It to lha smart card 1 0, The smart card 10 

an authenrjoAUon requaat. Trile iranamlsaien ta r«pr«> enorypta the reoalired random nwmfeer Rndl u»lne the 

aented by [IDnAPQ NAME] In Ag. 7, Trie card numtier «o uaer eeoret key Ww atared In Its' memory to eenerato » 

IbuandtheAPGMAMEftretranarnlKedvrllhoiiterioryp. response Real by maana of a function 

Hd». The Ape NAME wHlbe referred when auw osrllf- Reef-flflnttl.Ku), The mm card 1Q alio generates a 

loate Oert and an aulhenttoatlon information Aulnfoare randam number Rnd2. The Generated fsBponae Reel 

laswad later, and the random number Rnd2 are iranemftted to lha 

' The AuB 17 (fenaratee a random number ftnd and « Au017, 

traTiemlte It (called a challenge) to th» smart card 10, The Auo 17 Inojitres the uaer eecr«t key KU from 

The smart oard 10 then enoryfMe the reoetved landom ■ the received card mimbar IDu ue1nrj the database 17a. 

number Rnd u»tnrj the vm eeoret key tti etored In lis and then, executes the same encrypiion of the random 

memory to generate a response Has by means ot a number Rndl as done In the smart card 10 urine iho 

function RflB-t(RrKf,Ku). Ths (iterated reaponae Rea #o uaer eeoret key KU to generate Real' by meant of a 

lereturnedlothsAuC 17. The Au0 17 Inquires the user function ReeiVrftRncrurfti}, The generated Reel 1 Is 

eeoret key Kb froiji the received card number IDu using then compared with the response Rest transmitted 

the ctetftbaae 17*, and then, executes the tame enaryp- fwm lite emari card . 10. If the user it a isflltlmate uaer 

lion of the random number Rnd ae done in the smart and the uaer eeoret key Ku Is correct one, Reel will 

otnd 1o using the uear eeoret toy Ku to generate ftot? e» ootncldea wHb deal'. However, II the iiasr secret key KU 

by means of a function Rea'«f{fln*Ku). The generated !s Inaorrsnt, Iho calculated results Real and Rear will 

netf la then ccmpitwd with the reaponao' Rea transmit' not coincide with each ether. In Ihle oase, failure ol ths 

ted from ttte emarlcard 10. H the uaer lea leglllmata authentlSAtlonlslnformedtotheueerafdeandtheproO' 

user (tnot the user eecrel ksy Km Is correct one, Res will m te termEnatad, 
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ifth» enorypted Rsb1' aotofttaswHh Reel, follow- 



"Hie appllwllori Server 16 decrypts ihe transmitted 



lug procedure for authentication, the AuO 17 by the \sm osrlKtoate Gorl' using, ite AP8 secret key Kft to 

«mort cnrct 10 1) wrrted out, First, the AuO 17 smirypie extraot the original user csrllf lonfo Ctii Tften, thaappit- 

the wntlom number RndU transmitted from the smart cation astveMe ewltialewr verWeBiheuBeroerlHIuate 

card 10 uslno the vm secret key Kit to «»nsmta a « Oert by onarftfoji tow or oflimallve mr&mittUon ttiolt 

r«MOrl«a Rt>a by means of a funolton bb application server name, Issuance time or validity 

R«W>f(flnd2>Kti}. Then, the- AuO 17 feeuea a user oer* time period contained In the ceitllicata Carl, flor exam. 

tHIoate OBrtandanautnemtoatlon Information AuMo for pie, If the oerttfleete Oert Is forced one, no aljinrlloaM 

the smart oniti 10, Contents of trie laeued user oeriHI- tnfcrmattori onn b»«Kire<rt«* th«r« from awl thire ansiy- 

oate Garland authentloaitonlnbmtatloriAulrrroare (ndi- to tie of Inooerlfflimle Owl fulls, mn If iheflerllficfttacart 

dated tn Pig. 1 1 as ati ewmpfe, ts lefllllmate one, ml* ceuHloatB Oert may be dealt with 

In order toprawnlfrorrlffaiitfulant, the user oerlHI- Invalid when the vaMtf time le expired. 

QnleOertl«en«rypi6tluilrta«A^aaBDretl<e/Kaw}ilor> • SlnflOttw wer flertHloateOBrt'enoirypteil by using 

la shared only by trw AuC 17 and the APB 16 onrre- ' tba APS secret toy Ka Is vawmftled through tha nar> 

epondlnfj to the application server nam* APS NAME, to n work whan the smart card 10 awaeee to the appllca- 

produce cm\ Namely, by uttop; « cwloflrapMo l«no* Hon server 10. a fraudulent third parly may copies 

Hon f, Corf le obtained from CerMCOflri.Ka). Th* enoryptexl oerttfiOAte Oert' and may use It by stealth, In 

response His dulheniloHllai totofoiatton AulNfo order to prevent such rraudulartt usaao, a challenge' 

and the encrypted ueer oarttfloate. Owl' «W Iranemllted response. ftuihenUoatjon Is alga sxeouled bstvwen Bib 

to iris smart ofttd 14. Since the encrypted user oertHl' to smart card 10 «nd the application server 10, Namely, 

eale Cort'oannol be Analyzed at the user sttte, neaes- the application server 16 Generates; ft random number 

eary Heme such as art explrlna time aw transmitted In Rnd and Uansirfits it to the smart card 10. the smart 

duplicate. The smart card 10 Menules the same oard 10 encrypts the received random number. Rnt) 

encryption ol lh» random number Artda as done to the ualnrj the user and APS shared toy Ku-a contained In 

AmO 17 Wiethe user fiscal key Kutt Benerata Rssff the art heflHOfiM formation sent from iho AUG 17 

by mean* of a function ReBaw(Rnrj&.Kii). Tfia gener- when the user mtikm was rssued, lo generate a 

aled ReaS' la then qompared with the mwm Resa reeponse Rae b/meansof aturrtion Ret.t{Rfld^a). 

transmitted from the Au0 17, If the AuO lea leglttmftle 7hea«nerflt«tre»poriBeReiil»tranirnltt«ltolheappli- 

authmllwtlon eenler, Re&2 will oolncldaB with PteeS'. cation eerver 10, ■ 

ThSrelOM, In thle ease, the enorypted user oarllfl(Me 30 Hie application server 10 exeomea the »ame 

Oert' and the aulhBntloatton Information Aulnfo are enoiyptlnn ot the random number Pnd a* done In the 

stored In ihB memory In the smart card 10. However, If omart card 10 uelntj the mr and APSohnrod key Ku-a 

tfto Oftldytdled rwull* Resz and Bee? do not coincide which was wmatnad In the decrypted need cerintsate 

with caafi other, It fs Judged th&l the Au0 17 le not leolt* Oert to nensrets Res' by means of a function 

Imate on« and thus the authentloaflbn le failed, In this <w ttefl'-f{Rr>d,rOj-a). th» generaiad Res' l» then com- 

cm, tha iBsued UBer oertHtoate Oeit' and aulhenlloa- pared wllhtfiB response n4»tranem!ttedfrom ih8 smart 

lion Information Aulnte are canuslBd, oa«d 10. Ihhe user Is o tefllllmate usar. Roe will coin- 

in order to protect the auihentlotitlori Intormatton ohteswllh Retf, HowAver, If the uaar la atraitdulent user. 

Aulnfo and the W6t Oertllloate Oerl from being eaves- the 4a1uutated resulto nee and Res 1 will not coincide 

«|r«ped and fraudulently aceeseed by « thim party « wllh eaoh other, fn tWe case, aHhouah thacertillaMe 

vyhen ihey aratransmltted from the AuO 17to Ota emart OerHeoonaot, II maybe ueedbystsalth.TrmB,falfur*ot 

oard 10, the authentication information Aulnto and the the airthenttontlon le Informed to the user «td» and the 

user cflflflluala Oerf may be enorypted by a saealon key prooeas 1$ terinlnated. 

ehared by the Au0 17 and the smart oard 10, it is If the enorypted Rtf ooinnideB wiin Res, the 

deilradioprorJuDeaaeasIanKeylneooordanaawttrtthe 46 authenlldallon le euMeeded end the network eervloe 

random numbera Rnttl and 'RttdB and the user eeoret requaeted by the user Is provided to the e!t«n1 terminal 

Hey Ku shared onty by the Au0 17 and the emart oard 12. 

10, lha user and AP8 shared hey Ku a la contained In 

Flo, Q illueiratee procedure fn the second phase for both the user oeriHIoate and the aulhenUoaltoi [nfoima- 

re<iue8UnrjBndenJayfnrjanetwcrkfle(ulGe,Aeahownlrr so Won sent Ucm ihe Au0 17 to the smart card 16 (taring 

tht» «(jur*i at tlfel the anwypted user oerafloate Ceif the aoDesstrtft prooedurotothe AyC 17, shown In Fifle. 

which hae been elored In the smart esrd 10 le r«ad out 7 and ft Thle te also apparent from Pift. 11. Since the 

and transmitted lotheaptMon eerver tt, This trant- user wlHIuale la decrypted only by the appHcatlon 

mleeiort te rspretemod by [Oervj In Fig. 8. it ehouW be server lOhavIngthe APS eeorat key Ka amttheaulhert< 

noted that the user aerlHtaals Oerl' oan be Issued only w tloatlan Information is stored In the smart oard 10 not 

by the AuC 17 and oan bo evaluated only by tho appll- etorett (n the appMort server 10, this user and APS 

oatton eerver 10, and that not only thoamitrloard lObut shared key Kv-ata sent induplloate. Evenlf athlrdparty 



alsotha client terminal IB cannot analyao Ik 



eteale the user ooririioato enprypisd by the apS secret 
key Ka, ha oarviot analyze It. Therefore he cannot 
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Ffg, io llluef Alas procedure in Ihe second phage In 
the mutual wlhanitoatlon meonartlarn, As ♦hewn In Mis 
fifiure,«lNttt> atffrefc thoencrpptad uttroeriHiaaisOsri' 
whfoh has teen *tafe4 In Ihe emart card 10 Is mti out 



engrypt Ihe random number Rnd by using the us«r and 
APSetaredkayrfa*. 



Ilon'earver 16 enorypie ihe mnctom number Rntia ftwis» 
mined from the enwrl oard 10 using the new antt AP8 
e'nared key H&i«a Io generate a response Rea8 toy 
means of ftfwwtton ResfMtWnd&Ku'aMrwn, the gen* 
emted Rbbjj [a transmitted to the sntartflard 10. 



TheemRftoard 10 executes thesame encryption of 



and transmitted to the application wrver 16* This tram- the random number Rrrifi a* don* In the application 

mission is represented by tOwf) In Pig, io, It should be server 16 ustnfi the user and AP8 shared key Ktwt to 

noted lhat the UBeroerlHIpEite Cert' «an bo fwued only generate Rse2' by mean* cf a funmton 

by 1K» MO i7and can be evaluated only by the appii- «> Res8W(Rnt(i» I rfti-a}. Hhefisnorated Rooa'tBihen wm- 

OAlleneervtrlftandthAtnatontyineemEirtiMrdlObut pared wllrt ihe response Rosa transmitted from the 

elan the client terminal 12 osnnot analyze It, uppllaaUon server 1$. II the application asrvar is a legit- 

Tfie application server W decrypts the transmitted Imate one, Rasa will oDlnoWea with Roe*'. However, It 

user oariloate OerV using He APS seorel hey K« to th»«pplloaUpr> server la an tnoerreot one, the calculated 

extrdottrte original user wrtllloateOBil. Then, theappll. ftr results Hew and Rata 1 will notoolnoldewltheaohoihar. 

gallon eeiver devaluate* orvarHlBSthe wet ejrtffleale in thta cms, failure or Mb ftulnanltawtlon la Momut 10 

oert by ohecMriB towwn or eitlmaiive Information eucrt the uBor «nd the ptoobbb Ib terminated, 

as app)l(*llo» server name, Issuance time or validity If the encrypted Rwff coincide* with Rate, the 

time period contained In the oerttltMte Cert. For exam- mutual authenffwitton Is suooeeded autt the network 

pre, If the QftiHlDite Oert la forged one, ito eljrtflloant a» nervitw requested by the user fa provided to the client 

information oanbeeximotedtherGtrornandthuaanaiy- t«mlnol1&. 

ate ottheoerwiMteceriMia, Evan Hide oBrtnioa.teC«rt lh thla eeiwid embadlmarit, it la important thai the 

la legitimate one, this oerlHIwteClsrtniaybBdealt with usaroeriiltMtawhtohcan beuaedfonmeonnorettmaa 

[malldwhenthevalltlltyllrnala expired, le eaourely stored without barnnetolen by athlrdfiarty, 

Since the uaer csrtlf loals Cert' encrypted by using es For ihte purpose. It la etteotliie to execute cr^tonraphto 

the AP$ secret hey Kb, Ib transmitted through the nat- amotion wj(Mn an 10 oard provltfed with a CPU (smart 

workwhenthe ernaruajd 10 accesses tethe applies- card) whlohaan subjectively manafle a«««a» and to 

' tjan «»rver ie, .a fraudulant third parly may ooplsa thB atore a user oarlfflpate In tha oard. 

enarypied oef Irlltiate Oert' and may use It by stealth, In A» la daaarltoed In detail, awoidlrg to the preatnt 

.ordar to prevent euoti fraudulent mastfy the mutual sn Invenllen, an authentlaallon eysiem fidsplfng an 

autltenHoatlon la exeoulad oeiween the mul oard 10 authemlriatlon eoheme for verlrylnQ a war from a net' 

frndtheappllotHlonaervene, Namely, the application wortf.byahBllnathettrneflBorelfteybelweentheueer 

eetver to tjfwate&a random nurnber Rndl flhtt trariB- and the network encrypting a known Informalton ualnu 

mile Itto the mai oard 10. the »mwt card 10 enorypie the aeoret key at the uaer to produce Ifrat enovypted 

the received random number Rndl using the veer and so Information, (ransm'ttlrig t hp first enorypt«i information 

AP8 shared key Mu-ft oontehiBd In ihs qtttbarttloatton from the uaer to the netwailt, ennyptlng Ihe known 

Irrformatlwt sent from the AuB 17 wjian the deer oertKl- Intormatlon using the aaorat key at the network to pw 

cat* Issued, totienBwte* wponae (tea by msanB duoe eeoand encrypted Information, and collating the 

of a furtoDon Rae1«f(Rnd1,Ktt'a). The emart oard 10 tmnemltted tfrel worypted Information with the pro- 

atso gsneralaea random nuaVber Knit. Thefleperated to rfuoed eeoond enorypted IntormaltOh at the network, 

responw Real and the rantfcm number Rritfa are haa eyatam oomprlelno a etngle wrnalar anthertJloatlon 

twnamltted totheappllOAtlon «rver 10. (writer arranged In the network, the master autharHloa- 

The application earver le exeoutee the etme itoncanlBrefiartng with the ueor auaereaaret key, and 

enoryptlon of the random number Rnd «e done lh the n plurallly of elave auttiarWeatlon cenlere eharfng with 

amart card 10 using the user and AP8 ehared hey Kim « Hiemaeter atithantloatton oarttif reapBoilve aeeret kayo 

whlah wa» oontatned In f ha decrypted need certHlcale cUfterenl from the user eeoret hey. The master authontt- 

Oef I and eidraoted therefrom, to generate Real 1 by cation center anlhemicates ihe user by uefrtfl the uaer 

means ot a function Res1 , «J(Rndl l KU'a). The fiener- secret key anal iseues « certificate iitformaUan which 

ated R«ar la then compared with the retponse Reel certHleeleglHrHatlenoftheuaer, totheiieartftha uaorts 

iranamlitod from thesmert card 10. lithe userla ateojt- ea authentloatett ae a lafjlllmaia ueer. The etave aulhanll- 

Imate user, Reel wilt oolnolttae with Real 1 . However, II oallon center aulhentloates the aerlHlonte tnrormatlon 

theuserlear/auduienluaa^theoafcuiaiedreniitB^Reoi from the user and latuee a parmlatlon Information 

and Reei'wlll not coincide Willi each other. Inthlooaie, whiohallowaAnaoDaaatoaapeotiiedeftrvaroranappiN 

atlhwiflh the oarilltoate Oert l» correal. It may be used oatton WW tn the network, to ttie ueer If the ueer la 

by eteallh, Thus, fallureof theavthentloatlon le Intormad « aulhentlaaied ae a legitimate Ufl|r. 

toihe «b or aide and the prcaesa la termlneted. "ittBretore, In oaae of verifying a user by preaenllng 

It the enorypted ResT oatooWea with Reel, follow- a oaiouiatton reawlt of the uaere Inherent Information, 

Inft procedure for authenttoallnfi the application eerver authentloatlan proceeaeB can be axeouted by dtairtr)- 

lebytheerrtGitoardlDlaofliiledoirt.Flret.theappiioB- uted aerveie In the network without storing uear'e 
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secret information, in other worde, according to the 
present myentlon, by using a user ewtHtoate which |» 
valid for a predeteimlried period or predetermined 
times, aulhentlcallonprooBiaeaasnbe executed by dta' 
tributert servers In the n»iwork without enuring uwr'a a 
secret Information, A part of authentication toad oan be 
eUsi'etf by appllaatton wvw Instead cf slave aulhent> 
cnttonoenterfc 

(nnsarfuttire, decisions or purotweeBttncf sale's vtei 
ftwJde rarip nefworfteuoh as Inlemet orOAW network 10 
will arnWy \nmm, and therefore requeste of user 
aultienllcatlDrui vis a plurality of networks or within * 
single network will extremely Increase, According to the 
prwent fnventlon, a very Motive nuMlostlon sys- 
tem cm be provided under Ifwe clrotimBianBflB. rs 

1 Many widely dlMwarrt embodiments cf the present 
frwenlton may be conetHiolerf without departing from 
the spirit and scope ot tits present Invention, It should 
be understood trmttrmpretenl tnvinllon lenot limited 10 
the specific embofltrowtedflsoflbed InHiBspeBKloatJon, *c 
except «e defined In the appenrtedolalmB. 

GtaJnw 

1. An authentication system Adopting an authentloa- « 
Hon scheme for verifying a unor from a nstwork, by 
sharing the same secret Key btfwesn the user and 
the network, enorypllrtg « known triformallon using 
' said secret key at the uesr to produce first 
encrypted Inrormatlcn, trAnBitittttng the llrel aa 
encrypted Information from the tiger (0 the network, 
encrypting 8w (mown fofermation using ealcleeoret 
key «t the network to produce second encrypted 
Information, end oollaUng Ihe transmitted tlret 
snorypted Information wllh the produced eecon* w 
encrypted frrtomralion at the network 

said, system oomprlslng a single master 
aulnenUcaltoneenterairangBd In the hstawk sslc) 
master authentication canter sharing with the user 
a user easret toy, and a plurality of slave authsnil- ■» 
cation centerssharlng with eald mstttsraulheMtoa- 
tlort center respective *eor«t keys different from the 
user secret key, 

«atd roaster authentication oontor authsnit- 
- oalhQ Die user by using trnktuBeraeoret key and # 
■IsBUlnfl a narilffoftta formation to the user II the 
user te (Wlheffllcatetl as a leBlllmateuaer, said car- 
llllcAle information certifying legiirmallpj) ot the 
user, oft) stave authentication center authentlcat- 
trig the oertHtoate Information tronvthe mr and m 
teButng « permission fntofmatlon which allows an 
6M689 to a speoHfed server or an application 
server In the network to the ueer If the uBer le 
authenticated as a legitimate user, 

ss 

U> The authentlcfttlflrl system as claimed In otalm 1, 
WhBreJn saW eyatem adopts a mutual auttwnttoa- 
lion scheme for further verifying the network from 
the veer, by encrypting a known Information u»tnrj 
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eald sacrei key at the network to produce third 
enorjfitet) luformalloii, tfanemlttlng the third 
enorypted IntormatiorUromtrt* network to tho user, 
onoiyptlng the known Information using ettld'eesret 
key at the vbsx to produce fourth encrypted Infer* 
matJon, and oollatlnQ the transmitted tHW 
encrypted Intotmnlton with the produned fourth 
encrypted Intormation at the user. 

3. The aulhenMan system as Qtatmed fn claim 1, 
wherein spttd user has an to oard provided with a 
CPU and wherein the (Q card execute manage- 
ment of aatd uaar secret key and encr/pilon and 
decryption of the torormaitoit. 

4, Tfie aiMentlwtlton eyalem as olalmsd In claim 1, 
whBreln eald aeorat key used for encrypting the 
(mown information rs one using a random number 
inmaratedflttheuesr. 

a. An authentication system adopting an authentica- 
tion eoheme for verifying aiisertrorna network, by 
sharing th? cam* aeorei key between the ueer and 
the network, encrypting a (mown Information using 
Wild tecfol key at the ueer to produce tlret 

- encrypted rnfaiRMan, transmitting the tlret 
enoryptad Infornistientrom foe ueer to the network, 
encrypting Ihe known Information uelngaatd secret 
key at the network to produce second encrypted 
Informallun, and ooilatlng the transmitted llret 
encrypted Information wllh lie produced second 
encrypted Information at the network, 

eald netorork Issuing a certificate tnlMtnaHon 
10 the ueer If the user Is authenticated as a legHl- 
rnata user, said oetHflcata Information certifying 
jeglHmatton of theusfarandbelng valid wllhln apre- 
determined period or prtxtelermlned iime«. 

0, me auihcnMon eyetem ae otalmed In claim 6, 
wherein eald usBr ha* an 10 wrd proved with a 
OPU, and wherein the 10 card executes manage- 
meitt of eald user eccret to* managemsnt «f the 
cerlHIcate Information lecusd at the ristv/wk, and 
encryption end decryption of the infcrmaiton. 

7. The aulheffltoaJon eyetem as claimed In olatm B. 
wherein eald system adopts a mutual authentic* 
lion scheme for further verifying the network from 
the user, by enorypllng a known information using 
eald seoret key at the network (0 produce third 
ertatypted Information, transmuting the third 
encrypted fotwrnatlon from the network to the u»sr, 
enorypiing the known Infcntiatldn using eald secret 
fcfty fit the USM to pnxfuoe fourth enOryptad Infor- 
mation, and oolfatlna the transmlrted third 
enoructed Infcrmsllon with the produced fourth 
artorjptfld Infortnalton at the user, 
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